[fern-api]

🔧 Changes

Regenerates the Management API SDK on master from the latest stable spec, with Fern generator 3.107.6.

This release:

• adds the Universal Portals API, with discriminated union types for page and sidebar components;
• adds the Agent ID to client endpoints;
• fixes the consent signing keys list response body;
• adds agent_subject_claims on resource servers;
• adds Private Key JWT token-endpoint settings on SAML connections;
• adds oidc_support to client profile configuration.

The core runtime (core/, errors/, BaseClient.ts) and hand-written code (src/index.ts, wrapper/) are unchanged.

Universal Portals

• New client.portals with five methods:
  • list(): GET /portals; returns ListPortalsResponseContent ({ portals: PortalSummary[] }); not paginated;
  • create(...): POST /portals; slug, name and client are required; navigation, pages and custom_code are optional;
  • get(id): GET /portals/{id};
  • update(id, ...): PATCH /portals/{id}; all fields optional; navigation, pages and custom_code accept null;
  • delete(id): DELETE /portals/{id}.
• Errors:
  • 401 / 403 / 404 / 429 / 500 on all five methods;
  • 400 on create, get, update and delete;
  • 409 on create and update.
• New types:
  • Portal (id, name, slug, client?, navigation?, pages?, custom_code?, created_at, updated_at) and PortalSummary (id, name, slug, created_at, updated_at);
  • PortalClientSecretPostRequest (token_endpoint_auth_method: "client_secret_post", client_id, client_secret) for requests. Responses use PortalClientSecretPost, which omits client_secret, so the secret is never returned;
  • PortalNavigation (sidebar?: Sidebar), where Sidebar is { components?: SidebarComponent[] };
  • PortalPagesByType (default?: PageSlug, standard?: PortalPage[]) and PortalPage (title, slug, components?: PageComponent[]);
  • PortalCustomCode (head?), which is only injected when the portal is served from a custom domain;
  • nullable variants for updates: PortalNavigationNullable, PortalPagesByTypeNullable, PortalCustomCodeNullable.
• Discriminated unions, keyed on type:
  • PageComponent, with 11 variants:
    • page:component:auth0:form;
    • typography:heading and typography:rich_text;
    • media:image;
    • structure:section and structure:separator;
    • my_organization domain table, member management and details edit;
    • my_account passkey management and MFA management.
  • SidebarComponent, with 4 variants:
    • sidebar:component:auth0:external_link:v2 (label, href, icon?) and internal_link:v2 (label, page_slug, icon?);
    • the deprecated external_link (url) and internal_link (to); use the :v2 variants instead.
  • PageComponentNoChildren is the same set as PageComponent without structure:section. It types structure:section children, so sections can't be nested.
  • structure:section requires config.variant and config.children. For the my_organization, my_account and structure:separator variants, config is optional.
  • Switching on component.type narrows config to the variant's shape.
• New enums:
  • PageComponentAuth0StructureSectionVariantEnum (card | none);
  • PageComponentAuth0StructureSeparatorVariantEnum (dashed | none | solid);
  • Position (left | center | right), the alignment of media:image.
• OauthScope gains create:portals, read:portals, update:portals and delete:portals.
• New sub-package export: auth0/portals.

Clients – Agent ID

• New agent_id?: string on Client, ClientSearchResponse, and the Get / Create / Update / RotateSecret ClientResponseContent types.
• clients.create() and clients.update() accept agent_id?: string | null to associate an agent with the client (on update, null removes the association).
• clients.list() accepts an agent_id filter. Per the API docs, it can't be combined with other filters; only fields, include_fields, page, per_page and include_totals are supported alongside it; and checkpoint pagination (from / take) is not supported.

Users – consent signing keys response fix

• users.listConsentSigningKeys(id) now returns { keys: ConsentSigningKey[] } instead of a bare ConsentSigningKey[], matching the API's actual response body.
• ListUserConsentSigningKeysResponseContent changes from a type alias for an array to an interface with a required keys property.
• The JSDoc now says an empty keys array is returned when the user has no keys.
• This endpoint hasn't been released yet (added in feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436 after v7.6.0), so this is not a breaking change.

Other API changes

• Resource Servers: new agent_subject_claims? (off | auth0-v1):
  • on create / update requests (ResourceServerAgentSubjectClaimsSchemaEnum);
  • on all resource server response types (ResourceServerAgentSubjectClaimsResponseEnum).
• Connections – SAML Private Key JWT:
  • ConnectionOptionsSaml gains token_endpoint_auth_method?, token_endpoint_auth_signing_alg? and token_endpoint_jwtca_aud_format?, reusing the existing connection token-endpoint enums;
  • the connections.keys get, create and rotate JSDoc now lists SAML (samlp) alongside Okta and OIDC;
  • the ConnectionTokenEndpointJwtcaAudFormatEnumOidc JSDoc now describes issuer as the identity provider's issuer URL (previously "OIDC issuer URL").
• Client Profiles: ClientProfileClientConfiguration gains oidc_support?: { default_value: { is_allowed, allow_all_scopes?, allowed_scopes? } }, with allowed_scopes typed as profile | email | address | phone.
• Errors: new InternalServerErrorBody type (not yet referenced by any endpoint).

All other changes are additive; no exported declarations or properties are removed or narrowed.

Docs and dependencies

• reference.md regenerated:
  • portals methods added;
  • the clients.list() examples include agent_id;
  • the connections.keys descriptions mention SAML (samlp).
• package.json:
  • adds the ./portals export entry;
  • dependencies are unchanged.
• package.json / src/management/version.ts: the generator reset the version to 7.6.0, reverting the unreleased 7.6.1 bump from feat: add user consent signing keys, client oidc_support, connection otp_settings, and resource server type #1436.
• yarn.lock refreshed with transitive updates only.
• .fern/replay.lock updated for the new generation.

// Universal Portals
const portal = await client.portals.create({
    slug: "customer-portal",
    name: "Customer Portal",
    client: { token_endpoint_auth_method: "client_secret_post", client_id: "abc", client_secret: "s3cr3t" },
    navigation: {
        sidebar: {
            components: [
                { type: "sidebar:component:auth0:external_link:v2", config: { label: "Docs", href: "https://example.com/docs" } },
            ],
        },
    },
});

const { portals } = await client.portals.list();

// Discriminated unions narrow on `type`
function describeComponent(c: Management.PageComponent): string {
    switch (c.type) {
        case "page:component:auth0:form":
            return c.config.form_id;
        case "page:component:auth0:media:image":
            return c.config.src;
        default:
            return c.type;
    }
}

// Agent ID on clients
await client.clients.update("client_123", { agent_id: "agent_abc" });
const page = await client.clients.list({ agent_id: "agent_abc" });

// Consent signing keys: response is an object
const { keys } = await client.users.listConsentSigningKeys("auth0|123");
await client.users.deleteConsentSigningKey("auth0|123", keys[0].kid);

// Resource server agent subject claims
await client.resourceServers.update("rs_123", { agent_subject_claims: "auth0-v1" });

🔬 Testing

• wire/portals.test.ts (new, 36 tests): all five endpoints (list 6, create 8, get 7, update 8, delete 7), covering success and error paths, including 500.
• wire/users.test.ts: the listConsentSigningKeys fixture now uses { keys: [...] }.
• wire/clients.test.ts: agent_id added to the list request and the client response fixtures.
• wire/resourceServers.test.ts: agent_subject_claims added to the response fixtures.
• wire/clientProfiles.test.ts: oidc_support added to the client configuration fixtures.
• unit/stream/Stream.test.ts: the generator removed the Promise<ReadableStream> return type from the null-reconnect stub, which breaks compilation (TS2578 / TS2322). Commit b5d42c5b6c restores it, so there is no net change against master.
• Locally: yarn test passes 208/208 suites and 4901 tests. tsc --noEmit is clean, yarn build succeeds, and lint reports 0 errors (205 existing warnings).

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov]

Codecov Report

❌ Patch coverage is 90.09434% with 21 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.47%. Comparing base (1881e54) to head (b5d42c5).

Files with missing lines	Patch %	Lines
.../management/api/resources/portals/client/Client.ts	89.17%	21 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##           master    #1437    +/-   ##
========================================
  Coverage   89.46%   89.47%            
========================================
  Files         449      451     +2     
  Lines       22881    23092   +211     
  Branches    10882    11345   +463     
========================================
+ Hits        20471    20661   +190     
- Misses       2410     2431    +21     

Flag	Coverage Δ
alltests	89.47% <90.09%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/management/Client.ts	97.43% <100.00%> (+0.05%)	⬆️
.../management/api/resources/clients/client/Client.ts	89.56% <ø> (ø)
...ources/connections/resources/keys/client/Client.ts	89.47% <ø> (ø)
src/management/api/resources/index.ts	100.00% <100.00%> (ø)
src/management/api/resources/portals/index.ts	100.00% <100.00%> (ø)
...rc/management/api/resources/users/client/Client.ts	89.55% <ø> (ø)
src/management/api/types/types.ts	100.00% <100.00%> (ø)
src/management/version.ts	100.00% <100.00%> (ø)
.../management/api/resources/portals/client/Client.ts	89.17% <89.17%> (ø)

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[developerkunal]

LGTM