|
| 1 | +# v6 Migration Guide |
| 2 | + |
| 3 | +A guide to migrating the Auth0 Python SDK from v5 to v6. |
| 4 | + |
| 5 | +- [Overall changes](#overall-changes) |
| 6 | +- [Breaking changes](#breaking-changes) |
| 7 | + - [Federated connections tokensets removed](#federated-connections-tokensets-removed) |
| 8 | + - [`federated_connections_access_tokens` field removed](#federated_connections_access_tokens-field-removed) |
| 9 | + - [`read:federated_connections_tokens` / `delete:federated_connections_tokens` scopes removed](#readfederated_connections_tokens--deletefederated_connections_tokens-scopes-removed) |
| 10 | + - [`ClientSessionTransferDelegationDeviceBindingEnum` narrowed](#clientsessiontransferdelegationdevicebindingenum-narrowed) |
| 11 | + - [`ConnectionAttributeIdentifier` split into three types](#connectionattributeidentifier-split-into-three-types) |
| 12 | + - [`PhoneProviderProtectionBackoffStrategyEnum` value renamed](#phoneproviderprotectionbackoffstrategyenum-value-renamed) |
| 13 | + - [`ListRolesOffsetPaginatedResponseContent` pagination fields now required](#listrolesoffsetpaginatedresponsecontent-pagination-fields-now-required) |
| 14 | + |
| 15 | +## Overall changes |
| 16 | + |
| 17 | +v6 removes one deprecated Management API surface (federated connections |
| 18 | +tokensets) and tightens a handful of generated types to match the current |
| 19 | +Auth0 Management API contract. Most applications will only be affected if |
| 20 | +they use the specific types or endpoints listed below. |
| 21 | + |
| 22 | +The Authentication API is not affected by this release. |
| 23 | + |
| 24 | +## Breaking changes |
| 25 | + |
| 26 | +### Federated connections tokensets removed |
| 27 | + |
| 28 | +The `users.federated_connections_tokensets` sub-client and its `list`/`delete` |
| 29 | +methods have been removed, along with the `FederatedConnectionTokenSet` and |
| 30 | +`ConnectionFederatedConnectionsAccessTokens` types. This endpoint is no longer |
| 31 | +part of the Auth0 Management API. |
| 32 | + |
| 33 | +```python |
| 34 | +# v5 |
| 35 | +client.users.federated_connections_tokensets.list(id="user_id") |
| 36 | +client.users.federated_connections_tokensets.delete(id="user_id", tokenset_id="tokenset_id") |
| 37 | +``` |
| 38 | + |
| 39 | +```python |
| 40 | +# v6 |
| 41 | +# No replacement — the endpoint has been removed from the Management API. |
| 42 | +``` |
| 43 | + |
| 44 | +If you depend on this functionality, do not upgrade until you have confirmed |
| 45 | +an alternative with Auth0 support. |
| 46 | + |
| 47 | +### `federated_connections_access_tokens` field removed |
| 48 | + |
| 49 | +The optional `federated_connections_access_tokens` field has been removed |
| 50 | +from: |
| 51 | + |
| 52 | +- `ConnectionOptionsAzureAd` |
| 53 | +- `ConnectionOptionsCommonOidc` |
| 54 | +- `ConnectionOptionsGoogleApps` |
| 55 | +- `ConnectionPropertiesOptions` |
| 56 | +- `UpdateConnectionOptions` |
| 57 | + |
| 58 | +Any code reading or setting this field on the above types will need to |
| 59 | +remove that usage. Note that these models are configured with |
| 60 | +`extra="allow"`, so passing `federated_connections_access_tokens` is **not** |
| 61 | +silently dropped — it is retained on the model and still serialized into the |
| 62 | +outbound request. Remove the field explicitly rather than relying on the SDK |
| 63 | +to strip it. |
| 64 | + |
| 65 | +### `read:federated_connections_tokens` / `delete:federated_connections_tokens` scopes removed |
| 66 | + |
| 67 | +These two values are no longer valid members of `OauthScope`. Remove any |
| 68 | +references to them when requesting or checking scopes. |
| 69 | + |
| 70 | +### `ClientSessionTransferDelegationDeviceBindingEnum` narrowed |
| 71 | + |
| 72 | +The `"asn"` literal value has been removed. The enum now only accepts `"ip"`: |
| 73 | + |
| 74 | +```python |
| 75 | +# v5 |
| 76 | +ClientSessionTransferDelegationDeviceBindingEnum = typing.Union[typing.Literal["ip", "asn"], typing.Any] |
| 77 | +``` |
| 78 | + |
| 79 | +```python |
| 80 | +# v6 |
| 81 | +ClientSessionTransferDelegationDeviceBindingEnum = typing.Union[typing.Literal["ip"], typing.Any] |
| 82 | +``` |
| 83 | + |
| 84 | +If you were setting this value to `"asn"`, update it to `"ip"` — this matches |
| 85 | +the current Management API's accepted values. |
| 86 | + |
| 87 | +### `ConnectionAttributeIdentifier` split into three types |
| 88 | + |
| 89 | +`ConnectionAttributeIdentifier` has been removed with no compatibility alias. |
| 90 | +It is replaced by three narrower types, one per attribute: |
| 91 | + |
| 92 | +| Attribute field | v5 type | v6 type | Shape | |
| 93 | +| --- | --- | --- | --- | |
| 94 | +| `EmailAttribute.identifier` | `ConnectionAttributeIdentifier` | `EmailAttributeIdentifier` | `{active?, default_method?: DefaultMethodEmailIdentifierEnum}` | |
| 95 | +| `PhoneAttribute.identifier` | `ConnectionAttributeIdentifier` | `PhoneAttributeIdentifier` | `{active?, default_method?: DefaultMethodPhoneNumberIdentifierEnum}` | |
| 96 | +| `UsernameAttribute.identifier` | `ConnectionAttributeIdentifier` | `UsernameAttributeIdentifier` | `{active?}` (no `default_method`) | |
| 97 | + |
| 98 | +```python |
| 99 | +# v5 |
| 100 | +from auth0.management.types import ConnectionAttributeIdentifier |
| 101 | + |
| 102 | +identifier = ConnectionAttributeIdentifier(active=True, default_method="email_otp") |
| 103 | +``` |
| 104 | + |
| 105 | +```python |
| 106 | +# v6 |
| 107 | +from auth0.management.types import EmailAttributeIdentifier |
| 108 | + |
| 109 | +identifier = EmailAttributeIdentifier(active=True, default_method="email_otp") |
| 110 | +``` |
| 111 | + |
| 112 | +`EmailAttributeIdentifier` has the same shape as the old |
| 113 | +`ConnectionAttributeIdentifier` and is a drop-in replacement for code that |
| 114 | +was only ever used with `EmailAttribute`. Code using |
| 115 | +`ConnectionAttributeIdentifier` with `PhoneAttribute` or `UsernameAttribute` |
| 116 | +must switch to `PhoneAttributeIdentifier` or `UsernameAttributeIdentifier` |
| 117 | +respectively; `UsernameAttributeIdentifier` does not support |
| 118 | +`default_method`. |
| 119 | + |
| 120 | +### `PhoneProviderProtectionBackoffStrategyEnum` value renamed |
| 121 | + |
| 122 | +The `"none"` literal has been replaced with `"default"`: |
| 123 | + |
| 124 | +```python |
| 125 | +# v5 |
| 126 | +PhoneProviderProtectionBackoffStrategyEnum = typing.Union[typing.Literal["exponential", "none"], typing.Any] |
| 127 | +``` |
| 128 | + |
| 129 | +```python |
| 130 | +# v6 |
| 131 | +PhoneProviderProtectionBackoffStrategyEnum = typing.Union[typing.Literal["exponential", "default"], typing.Any] |
| 132 | +``` |
| 133 | + |
| 134 | +Replace any use of `"none"` with `"default"`. |
| 135 | + |
| 136 | +### `ListRolesOffsetPaginatedResponseContent` pagination fields now required |
| 137 | + |
| 138 | +`start`, `limit`, and `total` are no longer optional: |
| 139 | + |
| 140 | +```python |
| 141 | +# v5 |
| 142 | +start: typing.Optional[float] = None |
| 143 | +limit: typing.Optional[float] = None |
| 144 | +total: typing.Optional[float] = None |
| 145 | +``` |
| 146 | + |
| 147 | +```python |
| 148 | +# v6 |
| 149 | +start: float |
| 150 | +limit: float |
| 151 | +total: float |
| 152 | +``` |
| 153 | + |
| 154 | +Deserializing a role-list response that is missing any of these fields now |
| 155 | +raises `pydantic.ValidationError` instead of silently defaulting to `None`. |
| 156 | +This matches the Management API, which always returns these fields for this |
| 157 | +endpoint. |
0 commit comments