●Change8

6.0.0

Breaking Changes
📦 auth0View on GitHub →
⚠ 7 breaking✨ 10 features🔧 43 symbols

Summary

This major release introduces new endpoints, type changes, and significant breaking changes including the removal of federated connections tokensets and the restructuring of connection attribute identifiers. Review the breaking changes carefully before upgrading.

⚠️ Breaking Changes

  • `ConnectionAttributeIdentifier` removed and split into three types: `EmailAttributeIdentifier`, `PhoneAttributeIdentifier`, and `UsernameAttributeIdentifier`. The `identifier` field on each attribute now points to its respective new type. Use `EmailAttributeIdentifier` as a drop-in replacement for the old `ConnectionAttributeIdentifier`.
  • `PhoneProviderProtectionBackoffStrategyEnum` changed from `Literal["exponential", "none"]` to `Literal["exponential", "default"]`. Replace the value `"none"` with `"default"`.
  • `ListRolesOffsetPaginatedResponseContent.start`, `.limit`, and `.total` are now required `float` instead of `Optional[float] = None`. Deserializing a role-list response missing these fields will now raise `pydantic.ValidationError`.
  • The `users.federated_connections_tokensets` client and its `list`/`delete` methods, along with `FederatedConnectionTokenSet` and `ConnectionFederatedConnectionsAccessTokens` types, have been removed.
  • The `federated_connections_access_tokens` field has been removed from `ConnectionOptionsAzureAd`, `ConnectionOptionsCommonOidc`, `ConnectionOptionsGoogleApps`, `ConnectionPropertiesOptions`, and `UpdateConnectionOptions`.
  • OAuth scopes `read:federated_connections_tokens` and `delete:federated_connections_tokens` are no longer valid values of `OauthScope`.
  • `ClientSessionTransferDelegationDeviceBindingEnum` has been narrowed, removing the `"asn"` value. The enum now only accepts `"ip"`.

Migration Steps

  1. Replace `"none"` with `"default"` for `PhoneProviderProtectionBackoffStrategyEnum`.
  2. Ensure `start`, `limit`, and `total` fields are present when deserializing role-list responses.
  3. Remove usage of `users.federated_connections_tokensets` client and its methods.
  4. Remove the `federated_connections_access_tokens` field from relevant connection option types.
  5. Update OAuth scopes to remove `read:federated_connections_tokens` and `delete:federated_connections_tokens`.
  6. Update `ClientSessionTransferDelegationDeviceBindingEnum` to only use `"ip"`.

✨ New Features

  • New endpoint `organizations.roles.members.list(id=..., role_id=...)` (sync + async) for listing organization role members.
  • Organizations now support `third_party_client_access: Optional[OrganizationThirdPartyClientAccessEnum]` on `create()`/`update()` and all organization response types.
  • New types `ListOrganizationRoleMembersResponseContent` and `RoleMember` have been introduced.
  • Grants now include a new read-only `UserGrant.organization_id: Optional[str]`.
  • `discovery_url` and `oidc_metadata` are now extended to `samlp` connections, with new `ConnectionsDiscoveryUrl` and `ConnectionsOidcMetadata` types.
  • New event-type values for Event Streams: `connection.created`, `connection.deleted`, `connection.updated`. New payload types `EventStreamCloudEventConnection{Created,Deleted,Updated}*` and `EventStreamSubscribeEventsResponseContent`.
  • Token Vault now includes `grants: Optional[List[TokenVaultPrivilegedAccessGrant]]` on privileged-access credential/public-key types.
  • New error body types: `NotFoundErrorBody`/`NotFoundErrorBodyError`, `TooManyRequestsErrorBody`/`TooManyRequestsErrorBodyError`.
  • CloudEvent `specversion` is now `EventStreamCloudEventSpecVersionEnum` across group/org/user CloudEvent types.
  • New optional `auth0_managed: Optional[List[str]]` field in `NetworkAclMatch` for referencing Auth0-managed lists in network ACL rules.

Affected Symbols

`ConnectionAttributeIdentifier``EmailAttributeIdentifier``PhoneAttributeIdentifier``UsernameAttributeIdentifier``EmailAttribute.identifier``PhoneAttribute.identifier``UsernameAttribute.identifier``PhoneProviderProtectionBackoffStrategyEnum``ListRolesOffsetPaginatedResponseContent``pydantic.ValidationError``users.federated_connections_tokensets``FederatedConnectionTokenSet``ConnectionFederatedConnectionsAccessTokens``ConnectionOptionsAzureAd``ConnectionOptionsCommonOidc``ConnectionOptionsGoogleApps``ConnectionPropertiesOptions``UpdateConnectionOptions``OauthScope``ClientSessionTransferDelegationDeviceBindingEnum``organizations.roles.members.list``organizations.roles``organizations.roles.members``ListOrganizationRoleMembersResponseContent``RoleMember``UserGrant.organization_id``ConnectionsDiscoveryUrl``ConnectionsOidcMetadata``EventStreamEventTypeEnum``EventStreamDeliveryEventTypeEnum``EventStreamSubscribeEventsEventTypeEnum``EventStreamTestEventTypeEnum``EventStreamCloudEventConnectionCreated``EventStreamCloudEventConnectionDeleted``EventStreamCloudEventConnectionUpdated``EventStreamSubscribeEventsResponseContent``TokenVaultPrivilegedAccessGrant``NotFoundErrorBody``NotFoundErrorBodyError``TooManyRequestsErrorBody``TooManyRequestsErrorBodyError``EventStreamCloudEventSpecVersionEnum``NetworkAclMatch`