[fern-api]

🔧 Changes

Regenerates the Management API SDK on the beta track from the stable spec plus the beta-only spec files, with Fern generator 3.72.5 (unchanged from the current beta).

This release:

• removes the beta-only attack protection CAPTCHA policies (Beta);
• brings beta up to date with the stable API surface from v7.5.0, v7.6.0 and the current stable regeneration (feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436):
  • client profiles;
  • CIMD external metadata status and dynamic registration;
  • user consent signing keys;
  • oidc_support on Client responses;
  • otp_settings on database connections;
  • resource server type;
  • SAML cross-app-access requesting app fields;
  • the passkey Guardian factor;
  • transaction context on event stream CloudEvents;
  • experimentation updates;
  • a segment status filter.

After this PR, the names of beta's resources, public methods, exported types, request types and sub-package exports match stable. No beta-only endpoints remain.

The core runtime (core/, errors/, BaseClient.ts) is unchanged. beta stays on the 3.72.5 runtime, so it does not yet include stable's 3.107.x runtime changes.

Beta

• Attack Protection – CAPTCHA policies removed (Beta, added in feat: add attack protection CAPTCHA policies, client grants search, anonymous session network binding, DPoP strict refresh token binding; move experiment & feature flag status transitions to PATCH #1426)
  • client.attackProtection.captchaPolicies (list, create, get, update, delete on /attack-protection/captcha/policies) is removed, along with the CaptchaPoliciesClient class and the Management.attackProtection.captchaPolicies namespace export.
  • Removed types:
    • AttackProtectionCaptchaPolicy, AttackProtectionCaptchaPolicyMatch, AttackProtectionCaptchaPolicyAction, AttackProtectionCaptchaPolicyActionInput
    • ListAttackProtectionCaptchaPoliciesResponseContent, CaptchaActiveProviderEnum
    • CaptchaPolicyActionArkose / CaptchaPolicyActionArkoseInput, CaptchaPolicyActionFriendlyCaptcha / CaptchaPolicyActionFriendlyCaptchaInput, CaptchaPolicyActionHcaptcha / CaptchaPolicyActionHcaptchaInput, CaptchaPolicyActionRecaptchaEnterprise / CaptchaPolicyActionRecaptchaEnterpriseInput, CaptchaPolicyActionRecaptchaV2 / CaptchaPolicyActionRecaptchaV2Input, CaptchaPolicyActionAuthChallenge, CaptchaPolicyActionSimpleCaptcha
  • Removed request types: CreateAttackProtectionCaptchaPolicyRequestContent and UpdateAttackProtectionCaptchaPolicyRequestContent.
  • Removed sub-package export: auth0/attackProtection/captchaPolicies.
  • This mirrors the removal from the stable spec in v7.6.0 (feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428).

Stable (mirrored from master)

• Client Profiles (new on beta; stable since v7.5.0, feat: add client profiles, attack protection CAPTCHA policies, client grants search, and CIMD external metadata status / dynamic registration #1425)
  • New client.clientProfiles with five methods:
    • list({ from, take }): GET /client-profiles, checkpoint pagination, take defaults to 50;
    • create(...): POST /client-profiles; name, client_configuration and apply_policy are required;
    • get(id): GET /client-profiles/{id};
    • update(id, ...): PATCH /client-profiles/{id};
    • delete(id): DELETE /client-profiles/{id}.
  • New types:
    • ClientProfile, ClientProfileClientConfiguration and ClientProfileApplyPolicy;
    • aliases ClientProfileId, ClientProfileName and ClientProfileDescription;
    • ClientProfileClientConfigurationRefreshToken, with token_lifetime, idle_token_lifetime and leeway (ClientProfileRefreshTokenTokenLifetime, ClientProfileRefreshTokenIdleTokenLifetime, ClientProfileRefreshTokenLeeway, each { default_value? });
    • organization_usage, organization_require_behavior, organization_discovery_methods and require_proof_of_possession settings, with typed enums;
    • ListClientProfilesPaginatedResponseContent;
    • request types CreateClientProfileRequestContent, UpdateClientProfileRequestContent and ListClientProfilesRequestParameters.
  • apply_policy uses ClientProfileApplyPolicyExternalMetadataTypeEnum (cimd) and ClientProfileApplyPolicyExternalMetadataCreatedByEnum (client).
  • Creating a second profile in a tenant returns 409 Conflict.
  • OauthScope gains create:client_profiles, read:client_profiles, update:client_profiles and delete:client_profiles.
  • New sub-package export: auth0/clientProfiles.
• Clients – CIMD (stable since v7.5.0, feat: add client profiles, attack protection CAPTCHA policies, client grants search, and CIMD external metadata status / dynamic registration #1425)
  • New external_metadata_status?: ClientExternalMetadataStatusEnum (available | unavailable) on Client, ClientSearchResponse, and the Get / Create / Update / RotateSecret ClientResponseContent types.
  • PreviewCimdMetadataResponseContent gains external_metadata_created_by?: CimdExternalMetadataCreatedByEnum (admin | client).
• Tenant settings (stable since v7.5.0, feat: add client profiles, attack protection CAPTCHA policies, client grants search, and CIMD external metadata status / dynamic registration #1425)
  • New client_id_metadata_document_dynamic_registration_supported on UpdateTenantSettingsRequestContent and on the Get / Update tenant settings responses. It requires client_id_metadata_document_supported to be enabled.
  • The JSDoc for TenantSettingsFlags.dashboard_insights_view now marks it deprecated (it has no effect).
• Guardian (stable since v7.6.0, feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428): passkey added to GuardianFactorNameEnum. The factor-name JSDoc now includes passkey and its missing commas are fixed.
• Event Streams (stable since v7.6.0, feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428)
  • New optional EventStreamCloudEventContext.transaction (EventStreamCloudEventContextTransaction).
  • New enums: EventStreamCloudEventContextTransactionProtocolEnum, EventStreamCloudEventContextTransactionResponseModeEnum and EventStreamCloudEventContextTransactionResponseTypeItemEnum.
• Experimentation (stable since v7.6.0, feat: add SSE reconnection, passkey guardian factor, and additionalBodyParameters; reject dot-segment path params #1428; segment status is from feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436)
  • CreateExperimentRequestContent.allocation_strategy (percentage | segment) is now required (see ⚠️ Breaking changes).
  • UpdateVariationRequestContent.overrides now accepts null:
    • top-level keys merge into the stored overrides;
    • a key set to null is removed;
    • null or {} clears all overrides.
  • The exported UpdateVariationOverridesMap type changes from Record<string, unknown> to (Record<string, unknown> | null) | undefined (see ⚠️ Breaking changes).
  • is_valid (already present) is now documented on ExperimentListItem and the Create / Get / Update experiment responses.
  • experimentation.segments.list() accepts status?: SegmentStatusEnum | null (active | archived) and sends it as a query parameter.
• Users – consent signing keys (new; from the stable regeneration feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436)
  • users.listConsentSigningKeys(id): GET /users/{id}/consent-signing-keys. Returns ListUserConsentSigningKeysResponseContent (ConsentSigningKey[]).
  • users.getConsentSigningKey(id, kid): GET /users/{id}/consent-signing-keys/{kid}.
  • users.deleteConsentSigningKey(id, kid): DELETE /users/{id}/consent-signing-keys/{kid}.
  • New type ConsentSigningKey: kid, device_identifier, created_at, expires_at (all required).
  • Errors: 400 / 401 / 403 / 429 on all three, plus 404 on getConsentSigningKey.
• Clients – oidc_support (from feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436): new ClientOidcSupport (is_allowed?, allow_all_scopes?, allowed_scopes?) on Client, ClientSearchResponse, and the Get / Create / Update / RotateSecret ClientResponseContent types.
• Connections (from feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436)
  • New otp_settings?: ConnectionOtpSettings (email? / phone?, each ConnectionOtpChannelSettings with otp_length? and otp_expiry?) on ConnectionOptionsAuth0, ConnectionPropertiesOptions and UpdateConnectionOptions.
  • SAML: ConnectionOptionsSaml gains client_id? (ConnectionClientIdSamlxaaRequestingApp, an alias of ConnectionClientIdOidc) and client_secret? (ConnectionClientSecretSamlxaaRequestingApp, a string).
  • ConnectionResponseContentSaml, CreateConnectionRequestContentSaml and UpdateConnectionRequestContentSaml gain cross_app_access_requesting_app?.
• Resource Servers (from feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436): new type?: ResourceServerTypeEnum | null (universal_commerce_protocol_server) on create / update requests and all resource server response types.
• Attack Protection: form_submission_mode moves before max_attempts in the brute-force settings types. Ordering only; no type change.
• Docs and dependencies
  • reference.md regenerated:
    • CAPTCHA policies removed;
    • clientProfiles and the three consent signing key methods added;
    • the experiments example now includes allocation_strategy.
  • package.json:
    • the ./attackProtection/captchaPolicies export entry is replaced with ./clientProfiles;
    • the version is unchanged, because the Beta Auto-Release workflow sets it;
    • dependencies are unchanged.
  • yarn.lock refreshed with dev / transitive updates only.
  • .fern/replay.lock updated for the new generation.

⚠️ Breaking changes (relative to v7.5.0-beta.0)

• Removed client.attackProtection.captchaPolicies, the CaptchaPoliciesClient class, its types, its request types and the auth0/attackProtection/captchaPolicies sub-package export (see Beta).
• experiments.create() now requires allocation_strategy, so existing TypeScript calls without it fail to type-check. The SDK adds no runtime validation.
• UpdateVariationOverridesMap now includes null | undefined (low impact). The type is only wider, so every value accepted before is still accepted. Only code that reads a value annotated with this type directly (for example Object.keys(overrides)) may need a null check. The type is only used in UpdateVariationRequestContent.overrides.

Not breaking: the new GuardianFactorNameEnum (passkey) and OauthScope members are additive, and the brute-force field reorder is ordering only.

// Client profiles (one per tenant)
const profile = await client.clientProfiles.create({
    name: "Dynamic clients",
    client_configuration: {
        refresh_token: { token_lifetime: { default_value: 2592000 } },
        organization_usage: { default_value: "allow" },
    },
    apply_policy: { external_metadata_type: "cimd", external_metadata_created_by: "client" },
});

const page = await client.clientProfiles.list({ take: 50 });

// Consent signing keys
const keys = await client.users.listConsentSigningKeys("auth0|123");
await client.users.deleteConsentSigningKey("auth0|123", keys[0].kid);

// Experiments: allocation_strategy is now required
await client.experimentation.experiments.create({
    name: "Login A/B",
    feature_flag_id: "ff_123",
    authentication_flow: "authentication",
    allocation_strategy: "percentage",
});

// Resource server type, OTP settings, segment status
await client.resourceServers.create({ identifier: "https://ucp.example.com", type: "universal_commerce_protocol_server" });
await client.connections.update("con_123", { options: { otp_settings: { email: { otp_length: 6, otp_expiry: 900 } } } });
await client.experimentation.segments.list({ status: "active" });

🔬 Testing

• wire/clientProfiles.test.ts (new, 28 tests): all five endpoints, covering success and error paths.
• wire/attackProtection/captchaPolicies.test.ts: removed (32 tests) along with the resource.
• wire/users.test.ts: 16 new tests for consent signing keys (listConsentSigningKeys 1–5, getConsentSigningKey 1–6, deleteConsentSigningKey 1–5).
• wire/clients.test.ts: external_metadata_status and oidc_support added to the client response fixtures. external_metadata_created_by was added to the CIMD preview fixture.
• wire/tenants/settings.test.ts: client_id_metadata_document_dynamic_registration_supported added to the response fixtures.
• wire/experimentation/experiments.test.ts: allocation_strategy added to the create request fixtures and create() calls (the response fixtures already had it).
• wire/experimentation/segments.test.ts: status is passed to the list() call (the mock does not assert query parameters).
• wire/resourceServers.test.ts: type added to the list, create, search, get and update response fixtures.
• wire/attackProtection/bruteForceProtection.test.ts: fixture field order updated to match the type.
• Locally: yarn test passes 205/205 suites and 4,649 tests across the unit, wire and root projects. tsc --noEmit is clean, yarn build succeeds, and lint reports no errors.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov]

Codecov Report

❌ Patch coverage is 88.33333% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.38%. Comparing base (6753ff5) to head (aa47d0f).
⚠️ Report is 1 commits behind head on beta.

Files with missing lines	Patch %	Lines
...rc/management/api/resources/users/client/Client.ts	87.36%	12 Missing ⚠️
...ment/api/resources/clientProfiles/client/Client.ts	86.76%	9 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             beta    #1435      +/-   ##
==========================================
- Coverage   89.39%   89.38%   -0.01%     
==========================================
  Files         446      446              
  Lines       22022    22130     +108     
  Branches    10531    10938     +407     
==========================================
+ Hits        19686    19782      +96     
- Misses       2336     2348      +12     

Flag	Coverage Δ
alltests	89.38% <88.33%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/management/Client.ts	97.38% <100.00%> (+0.05%)	⬆️
...nt/api/resources/attackProtection/client/Client.ts	100.00% <ø> (ø)
.../api/resources/attackProtection/resources/index.ts	100.00% <ø> (ø)
...c/management/api/resources/clientProfiles/index.ts	100.00% <ø> (ø)
...rimentation/resources/experiments/client/Client.ts	88.71% <ø> (ø)
...xperimentation/resources/segments/client/Client.ts	88.88% <100.00%> (+0.05%)	⬆️
...ources/guardian/resources/factors/client/Client.ts	90.36% <ø> (ø)
src/management/api/resources/index.ts	100.00% <100.00%> (ø)
src/management/api/types/types.ts	100.00% <100.00%> (ø)
...ment/api/resources/clientProfiles/client/Client.ts	88.64% <86.76%> (ø)
... and 1 more

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.