feat(generated): Add new classes and fields for API key validation and dsync tokens by workos-sdk-automation[bot] · Pull Request #378 · workos/workos-php

workos-sdk-automation · 2026-04-30T20:02:54Z

Summary

New classes added: ApiKeyValidationResponseApiKey, ApiKeyValidationResponseApiKeyOwner, DsyncTokenCreated, DsyncTokenCreatedData, DsyncTokenDeleted, DsyncTokenDeletedData, UserOrganizationMembershipBaseWithUser
New fields added: name field added to DirectoryUser, DirectoryUserWithGroups, DsyncUserUpdatedData, and Profile classes
New fields added: user field added to OrganizationMembership and UserOrganizationMembership classes
Type change: ApiKeyValidationResponse.apiKey field type changed from ApiKey to ApiKeyValidationResponseApiKey (more specific type for response context)
Enum extended: EventContextActorSource enum now includes AdminPortal case
Method return type updated: Authorization service methods listMembershipsForResourceByExternalId and listMembershipsForResource now return UserOrganizationMembershipBaseWithUser instead of UserOrganizationMembershipBaseListData
Documentation update: Updated deprecation notice for groups field in DirectoryUserWithGroups recommending migration to List Directory Groups endpoint

Triggered by workos/openapi-spec@91fc76a

…d dsync tokens

greptile-apps · 2026-04-30T20:05:11Z

Greptile Summary

This auto-generated PR adds new resource classes for API key validation, dsync token events, and membership-with-user shapes, while also extending several existing classes with name and user fields. Two P0 bugs were introduced: ApiKeyCreatedData and ApiKeyRevokedData both pass the raw $data['owner'] array directly to a constructor parameter typed as the corresponding owner object, which will throw a TypeError at runtime on every deserialization call.

P0 — ApiKeyCreatedData::fromArray() and ApiKeyRevokedData::fromArray() pass $data['owner'] (array) to a typed ApiKeyCreatedDataOwner/ApiKeyRevokedDataOwner property; the ::fromArray() call was dropped in this diff and must be restored.
P1 — OrganizationMembership, UserOrganizationMembership, and UserOrganizationMembershipBaseWithUser access $data['user'] without a null/isset guard; any response that omits the field will produce an Undefined array key error.

Confidence Score: 1/5

Not safe to merge — two P0 TypeErrors will break API key event deserialization at runtime.

Two P0 bugs (TypeError in ApiKeyCreatedData and ApiKeyRevokedData) plus a P1 missing null guard across three membership classes pull the score to 1. The P0s affect any code path that processes api_key.created or api_key.revoked webhook events.

lib/Resource/ApiKeyCreatedData.php and lib/Resource/ApiKeyRevokedData.php are broken; lib/Resource/OrganizationMembership.php, UserOrganizationMembership.php, and UserOrganizationMembershipBaseWithUser.php need null guards on the user key.

Important Files Changed

Filename	Overview
lib/Resource/ApiKeyCreatedData.php	P0 bug: `fromArray` passes raw array for `owner` but constructor declares it as `ApiKeyCreatedDataOwner` — will throw `TypeError` at runtime
lib/Resource/ApiKeyRevokedData.php	P0 bug: same `owner` type-mismatch issue as `ApiKeyCreatedData` — `fromArray` passes raw array instead of `ApiKeyRevokedDataOwner::fromArray(...)`
lib/Resource/OrganizationMembership.php	Adds required `user` field via `User::fromArray($data['user'])` with no null guard; will error on any response missing the key
lib/Resource/UserOrganizationMembership.php	Adds required `user` field with same missing null guard pattern as OrganizationMembership
lib/Resource/ApiKeyValidationResponseApiKey.php	New class replacing `ApiKey` in validation response context; correct `fromArray`/`toArray` implementation
lib/Resource/UserOrganizationMembershipBaseWithUser.php	New class for membership listings with embedded user; `user` deserialization also lacks null guard on `$data['user']`
lib/Service/Authorization.php	Return types updated from `UserOrganizationMembershipBaseListData` to `UserOrganizationMembershipBaseWithUser` for two list methods; straightforward change
lib/Resource/DsyncTokenCreated.php	New event class for dsync token creation; implementation looks correct
lib/Resource/DsyncTokenDeleted.php	New event class for dsync token deletion; mirrors DsyncTokenCreated correctly
lib/Resource/Profile.php	Adds optional `name` field; correctly placed after positional required params with `?? null` guard

Class Diagram

%%{init: {'theme': 'neutral'}}%%
classDiagram
    class ApiKeyValidationResponse {
        +ApiKeyValidationResponseApiKey apiKey
    }
    class ApiKeyValidationResponseApiKey {
        +string id
        +string name
        +ApiKeyValidationResponseApiKeyOwner owner
        +string obfuscatedValue
        +DateTimeImmutable createdAt
    }
    class ApiKeyValidationResponseApiKeyOwner {
        +string type
        +string id
    }
    ApiKeyValidationResponse --> ApiKeyValidationResponseApiKey
    ApiKeyValidationResponseApiKey --> ApiKeyValidationResponseApiKeyOwner

    class OrganizationMembership {
        +User user
    }
    class UserOrganizationMembership {
        +User user
    }
    class UserOrganizationMembershipBaseWithUser {
        +User user
    }
    OrganizationMembership --> User
    UserOrganizationMembership --> User
    UserOrganizationMembershipBaseWithUser --> User

    class DsyncTokenCreated {
        +DsyncTokenCreatedData data
    }
    class DsyncTokenCreatedData {
        +string directoryId
        +string tokenSuffix
        +DateTimeImmutable expiresAt
    }
    class DsyncTokenDeleted {
        +DsyncTokenDeletedData data
    }
    class DsyncTokenDeletedData {
        +string directoryId
        +string tokenSuffix
    }
    DsyncTokenCreated --> DsyncTokenCreatedData
    DsyncTokenDeleted --> DsyncTokenDeletedData

    class ApiKeyCreatedData {
        +ApiKeyCreatedDataOwner owner
    }
    class ApiKeyRevokedData {
        +ApiKeyRevokedDataOwner owner
    }

_{Reviews (1): Last reviewed commit: "feat(generated): Add new classes and fie..." | Re-trigger Greptile}

greptile-apps · 2026-04-30T20:05:15Z

            object: $data['object'] ?? 'api_key',
            id: $data['id'],
-            owner: ApiKeyCreatedDataOwner::fromArray($data['owner']),
+            owner: $data['owner'],


TypeError: raw array passed to typed ApiKeyCreatedDataOwner property

$data['owner'] is a plain array, but the constructor declares owner as ApiKeyCreatedDataOwner. PHP will throw a TypeError at runtime on any call to ApiKeyCreatedData::fromArray(). The diff removed the ApiKeyCreatedDataOwner::fromArray($data['owner']) call that was there before.

Suggested change

owner: $data['owner'],

owner: ApiKeyCreatedDataOwner::fromArray($data['owner']),

greptile-apps · 2026-04-30T20:05:18Z

            object: $data['object'] ?? 'api_key',
            id: $data['id'],
-            owner: ApiKeyRevokedDataOwner::fromArray($data['owner']),
+            owner: $data['owner'],


TypeError: raw array passed to typed ApiKeyRevokedDataOwner property

Same issue as ApiKeyCreatedData: $data['owner'] is an array but the constructor expects ApiKeyRevokedDataOwner. Every call to ApiKeyRevokedData::fromArray() will throw a TypeError.

Suggested change

owner: $data['owner'],

owner: ApiKeyRevokedDataOwner::fromArray($data['owner']),

greptile-apps · 2026-04-30T20:05:20Z

            createdAt: new \DateTimeImmutable($data['created_at']),
            updatedAt: new \DateTimeImmutable($data['updated_at']),
            role: SlimRole::fromArray($data['role']),
+            user: User::fromArray($data['user']),


Missing null guard on required user key

$data['user'] is accessed without a null/isset check. If any API response omits the user field (e.g. older SDK responses or partial payloads), this will throw an Undefined array key "user" error. The same pattern appears in UserOrganizationMembership.php and UserOrganizationMembershipBaseWithUser.php.

devin-ai-integration

Devin Review found 4 potential issues.

View 3 additional findings in Devin Review.

devin-ai-integration · 2026-04-30T20:05:53Z

            object: $data['object'] ?? 'api_key',
            id: $data['id'],
-            owner: ApiKeyCreatedDataOwner::fromArray($data['owner']),
+            owner: $data['owner'],


🔴 ApiKeyCreatedData::fromArray passes raw array to typed ApiKeyCreatedDataOwner parameter

The fromArray method at line 44 passes $data['owner'] (a raw associative array from JSON decode) directly to the constructor, but the owner parameter is typed as ApiKeyCreatedDataOwner (line 20). With declare(strict_types=1) at the top of the file, this will throw a TypeError at runtime: "Cannot pass value of type array to parameter $owner of type ApiKeyCreatedDataOwner". The previous code correctly called ApiKeyCreatedDataOwner::fromArray($data['owner']). The same issue exists in toArray() at line 59, where $this->owner is output directly instead of calling $this->owner->toArray().

Suggested change

owner: $data['owner'],

owner: ApiKeyCreatedDataOwner::fromArray($data['owner']),

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-04-30T20:05:55Z

            'object' => $this->object,
            'id' => $this->id,
-            'owner' => $this->owner->toArray(),
+            'owner' => $this->owner,


🔴 ApiKeyCreatedData::toArray outputs owner object directly instead of calling toArray()

At line 59, toArray() outputs 'owner' => $this->owner directly. Since $this->owner is typed as ApiKeyCreatedDataOwner, this should be $this->owner->toArray() to properly serialize the object to an array, consistent with the pattern used in all other resource classes. If BUG-0001 is fixed (so $this->owner is a proper ApiKeyCreatedDataOwner object), this line will put an object into the array instead of a serialized array representation.

Suggested change

'owner' => $this->owner,

'owner' => $this->owner->toArray(),

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-04-30T20:05:56Z

            object: $data['object'] ?? 'api_key',
            id: $data['id'],
-            owner: ApiKeyRevokedDataOwner::fromArray($data['owner']),
+            owner: $data['owner'],


🔴 ApiKeyRevokedData::fromArray passes raw array to typed ApiKeyRevokedDataOwner parameter

Identical issue to ApiKeyCreatedData: line 44 passes $data['owner'] (a raw array) to the constructor, but the owner parameter is typed as ApiKeyRevokedDataOwner (lib/Resource/ApiKeyRevokedData.php:20). With declare(strict_types=1), this throws a TypeError at runtime. The previous code correctly called ApiKeyRevokedDataOwner::fromArray($data['owner']).

Suggested change

owner: $data['owner'],

owner: ApiKeyRevokedDataOwner::fromArray($data['owner']),

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-04-30T20:05:58Z

            'object' => $this->object,
            'id' => $this->id,
-            'owner' => $this->owner->toArray(),
+            'owner' => $this->owner,


🔴 ApiKeyRevokedData::toArray outputs owner object directly instead of calling toArray()

At line 59, toArray() outputs 'owner' => $this->owner directly instead of $this->owner->toArray(), identical to the issue in ApiKeyCreatedData. This will produce incorrect serialization output.

Suggested change

'owner' => $this->owner,

'owner' => $this->owner->toArray(),

Was this helpful? React with 👍 or 👎 to provide feedback.

feat(generated): Add new classes and fields for API key validation an…

3557ee9

…d dsync tokens

workos-sdk-automation Bot added the autogenerated Autogenerated code or content label Apr 30, 2026

workos-sdk-automation Bot requested review from a team as code owners April 30, 2026 20:02

workos-sdk-automation Bot requested a review from mattgd April 30, 2026 20:02

greptile-apps Bot reviewed Apr 30, 2026

View reviewed changes

devin-ai-integration Bot reviewed Apr 30, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(generated): Add new classes and fields for API key validation and dsync tokens#378

feat(generated): Add new classes and fields for API key validation and dsync tokens#378
workos-sdk-automation[bot] wants to merge 1 commit intomainfrom
oagen/spec-update-91fc76ae21e088f16365ddfab59bf9c29940d135

workos-sdk-automation Bot commented Apr 30, 2026 •

edited by devin-ai-integration Bot

Loading

Uh oh!

greptile-apps Bot commented Apr 30, 2026

Class Diagram

Uh oh!

greptile-apps Bot Apr 30, 2026

Uh oh!

greptile-apps Bot Apr 30, 2026

Uh oh!

greptile-apps Bot Apr 30, 2026

Uh oh!

devin-ai-integration Bot left a comment

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

	owner: $data['owner'],
	owner: ApiKeyCreatedDataOwner::fromArray($data['owner']),

	owner: $data['owner'],
	owner: ApiKeyRevokedDataOwner::fromArray($data['owner']),

Conversation

workos-sdk-automation Bot commented Apr 30, 2026 • edited by devin-ai-integration Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Uh oh!

greptile-apps Bot commented Apr 30, 2026

Greptile Summary

Confidence Score: 1/5

Important Files Changed

Class Diagram

Uh oh!

greptile-apps Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot left a comment

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

devin-ai-integration Bot Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

workos-sdk-automation Bot commented Apr 30, 2026 •

edited by devin-ai-integration Bot

Loading