Skip to content

Mount IT contacts on the Organizations service #110

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonatascastro12 merged 2 commits into from
Aug 24, 2026
Merged

Mount IT contacts on the Organizations service #110

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7a5e917
Mount IT contacts on their own ItContacts service
jonatascastro12 Aug 20, 2026
7739c4b
Mount IT contacts on Organizations
jonatascastro12 Aug 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/policy/mount-rules.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,9 @@ export const mountRules: Record<string, string> = {
// Org-scoped authorized applications -> Organizations
OrganizationsAuthorizedApplications: 'Organizations',

// Org-scoped IT contacts -> Organizations
OrganizationsItContacts: 'Organizations',

// User Management sub-services -> UserManagement, except the
// OrganizationMembership family (longer wildcard prefix wins) and the three
// exact entries below/above (exact always beats a wildcard):
Expand Down
15 changes: 15 additions & 0 deletions src/policy/operation-hints.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,21 @@ export const operationHints: Record<string, OperationHint> = {
name: 'list_authorized_applications',
},

// -- IT contacts (mounted on Organizations) -----------------------------------
// Drop the `organization` prefix the path would otherwise produce, and name
// the invite/revoke sub-resources after the action.
'GET /organizations/{organization_id}/it_contacts': { name: 'list_it_contacts' },
'POST /organizations/{organization_id}/it_contacts': { name: 'create_it_contact' },
'DELETE /organizations/{organization_id}/it_contacts/{contact_id}': {
name: 'delete_it_contact',
},
'POST /organizations/{organization_id}/it_contacts/{contact_id}/invite': {
name: 'invite_it_contact',
},
'POST /organizations/{organization_id}/it_contacts/{contact_id}/revoke': {
name: 'revoke_it_contact',
},

@mattgd mattgd Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on the change above, what do the SDK methods end up looking like?

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Node (other langs get the same names in their own casing):

await workos.organizations.listItContacts({ organizationId });
await workos.organizations.createItContact({ organizationId, email });
await workos.organizations.deleteItContact({ organizationId, contactId });
await workos.organizations.inviteItContact({ organizationId, contactId, intents: ['sso'] });
await workos.organizations.revokeItContact({ organizationId, contactId });

Without the hints they'd be workos.organizationsItContacts.listOrganizationItContacts(...) etc. See workos/workos-node#1681 for the actual implementation.

@mattgd mattgd Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do we do for organization domains currently?

@devin-ai-integration devin-ai-integration Bot Aug 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Organization domains are the other shape: the API itself is top-level, not nested — POST /organization_domains (with organization_id in the body), GET|DELETE /organization_domains/{id}, POST /organization_domains/{id}/verify — so they need no mount rule or hints, and the SDK gets workos.organizationDomains.createOrganizationDomain({ organizationId, domain }) / getOrganizationDomain(id) / verifyOrganizationDomain(id) / deleteOrganizationDomain(id).

IT contacts can't follow that without changing the shipped API paths, which is the option we ruled out above. The closest nested precedent is Groups (/organizations/{organizationId}/groups), which is mounted top-level as workos.groups.* — this PR deliberately doesn't follow that one per jonatas' call to keep the SDK consistent with the API hierarchy.


// -- External ID lookups (not derivable from path) ----------------------------
'GET /organizations/external_id/{external_id}': { name: 'get_organization_by_external_id' },
'GET /user_management/users/external_id/{external_id}': { name: 'get_user_by_external_id' },
Expand Down