From 7a5e9171f6dd30c323689940c86ebd1ab903ad0d Mon Sep 17 00:00:00 2001 From: jonatas Date: Thu, 20 Aug 2026 18:03:31 +0000 Subject: [PATCH 1/2] Mount IT contacts on their own ItContacts service Default resolution produced organizationsItContacts.listOrganizationItContacts and createItContactInvite. Mount the OrganizationsItContacts tag on ItContacts and name the operations after the resource/action, matching Groups. No SDK has generated IT Contacts yet, so no compat baseline is affected. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- src/policy/mount-rules.ts | 3 +++ src/policy/operation-hints.ts | 15 +++++++++++++++ 2 files changed, 18 insertions(+) diff --git a/src/policy/mount-rules.ts b/src/policy/mount-rules.ts index 4b04044..149b2c3 100644 --- a/src/policy/mount-rules.ts +++ b/src/policy/mount-rules.ts @@ -54,6 +54,9 @@ export const mountRules: Record = { // Org-scoped authorized applications -> Organizations OrganizationsAuthorizedApplications: 'Organizations', + // Org-scoped IT contacts -> ItContacts (own service, like Groups) + OrganizationsItContacts: 'ItContacts', + // User Management sub-services -> UserManagement, except the // OrganizationMembership family (longer wildcard prefix wins) and the three // exact entries below/above (exact always beats a wildcard): diff --git a/src/policy/operation-hints.ts b/src/policy/operation-hints.ts index ea34628..0db6778 100644 --- a/src/policy/operation-hints.ts +++ b/src/policy/operation-hints.ts @@ -55,6 +55,21 @@ export const operationHints: Record = { name: 'list_authorized_applications', }, + // -- IT contacts (mounted on ItContacts) -------------------------------------- + // Drop the `organization` prefix the path would otherwise produce, and name + // the invite/revoke sub-resources after the action. + 'GET /organizations/{organization_id}/it_contacts': { name: 'list_it_contacts' }, + 'POST /organizations/{organization_id}/it_contacts': { name: 'create_it_contact' }, + 'DELETE /organizations/{organization_id}/it_contacts/{contact_id}': { + name: 'delete_it_contact', + }, + 'POST /organizations/{organization_id}/it_contacts/{contact_id}/invite': { + name: 'invite_it_contact', + }, + 'POST /organizations/{organization_id}/it_contacts/{contact_id}/revoke': { + name: 'revoke_it_contact', + }, + // -- External ID lookups (not derivable from path) ---------------------------- 'GET /organizations/external_id/{external_id}': { name: 'get_organization_by_external_id' }, 'GET /user_management/users/external_id/{external_id}': { name: 'get_user_by_external_id' }, From 7739c4baf6edc09117a7a6c56470a086dd27b09b Mon Sep 17 00:00:00 2001 From: jonatas Date: Mon, 24 Aug 2026 13:17:21 +0000 Subject: [PATCH 2/2] Mount IT contacts on Organizations IT contacts are a subresource of organization in the API, so keep the SDK surface consistent: workos.organizations.listItContacts(...). Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- src/policy/mount-rules.ts | 4 ++-- src/policy/operation-hints.ts | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/policy/mount-rules.ts b/src/policy/mount-rules.ts index 149b2c3..18d148e 100644 --- a/src/policy/mount-rules.ts +++ b/src/policy/mount-rules.ts @@ -54,8 +54,8 @@ export const mountRules: Record = { // Org-scoped authorized applications -> Organizations OrganizationsAuthorizedApplications: 'Organizations', - // Org-scoped IT contacts -> ItContacts (own service, like Groups) - OrganizationsItContacts: 'ItContacts', + // Org-scoped IT contacts -> Organizations + OrganizationsItContacts: 'Organizations', // User Management sub-services -> UserManagement, except the // OrganizationMembership family (longer wildcard prefix wins) and the three diff --git a/src/policy/operation-hints.ts b/src/policy/operation-hints.ts index 0db6778..ac62d5e 100644 --- a/src/policy/operation-hints.ts +++ b/src/policy/operation-hints.ts @@ -55,7 +55,7 @@ export const operationHints: Record = { name: 'list_authorized_applications', }, - // -- IT contacts (mounted on ItContacts) -------------------------------------- + // -- IT contacts (mounted on Organizations) ----------------------------------- // Drop the `organization` prefix the path would otherwise produce, and name // the invite/revoke sub-resources after the action. 'GET /organizations/{organization_id}/it_contacts': { name: 'list_it_contacts' },