Skip to content

CHANGELOG.md

Latest commit

 

History

History
754 lines (527 loc) · 49.3 KB

CHANGELOG.md

File metadata and controls

754 lines (527 loc) · 49.3 KB
Raw

Change Log

6.6.0 (2026-09-17)

Full Changelog

Added

  • Organization connection member access level, resource server access token configuration, and client My Organization enforcement settings #892 (fern-api[bot])

6.5.0 (2026-09-11)

Full Changelog

⚠️ Breaking Changes

  • management.organization_templates client removed along with ListOrganizationTemplatesPaginatedResponseContent and OrganizationTemplateAssignedOrganization. Four connection providers dropped the -mcp suffix (asana-mcp becomes asana, atlassian-mcp becomes atlassian, gitlab-mcp becomes gitlab, slack-mcp becomes slack) and nine values removed entirely (docusign-mcp, figma-mcp, gusto-mcp, heroku-mcp, intercom-mcp, pagerduty-mcp, supabase-mcp, vercel-mcp, xero-mcp) #890 (fern-api[bot])

Added

  • Guardian MFA settings (GET/PUT /api/v2/guardian/settings), email and phone factor settings, organizations search, resource servers search, experimentation client, anonymous sessions support on clients and tenant settings, resource server anonymous access token configuration, and GatewayTimeoutError for HTTP 504 #890 (fern-api[bot])

6.4.0 (2026-09-02)

Full Changelog

⚠️ Breaking Changes

  • Client app_type b2b_integration removed (configure via b2b_integration_configuration instead); EventStreamCloudEventContextTenant.tenant_id renamed to id #888 (fern-api[bot])

Added

  • Organization templates client, client B2B integration configuration, network ACL HTTP message signatures and key deletion, connection profile SCIM provisioning, OIDC/Okta pushed authorization request support, SAML discovery_url/oidc_metadata/cross_app_access_resource_app options, tenant local_resource_discovery flag, forms server_key, post-credential-validation action trigger and consent-tenant-scopes screen group, and UnprocessableEntityError for HTTP 422 #888 (fern-api[bot])

Fixed

  • Raw management.connections client now surfaces 422 errors; raw management.connections.scim_configuration now surfaces 409 errors; management.users.organizations.list docstring updated for checkpoint pagination #888 (fern-api[bot])

6.3.0 (2026-08-19)

Full Changelog

Added

  • feat: Add My Organization client access control, Connection Profile Cross-App Access support, Network ACL keys management, and OIDC space-delimited scope support #886 (fern-api[bot])

Fixed

  • fix: Raw clients for forms and flows now surface additional error responses instead of failing unhandled, corrected a docstring field name #886 (fern-api[bot])

6.2.0 (2026-08-05)

Full Changelog

Added

  • feat: Add agents management, organization-client associations, organization-level roles (groups/members), network ACL keys, and directory provisioning group sync selections #881 (fern-api[bot])

Fixed

  • fix: EventStreamCloudEvent.data now deserializes as its actual object shape (Dict[str, Any]) instead of an opaque JSON-encoded string that callers had to json.loads() themselves. #881 (fern-api[bot])

6.1.0 (2026-07-22)

Full Changelog

Added

  • feat: Cross App Access (ID-JAG), branding theme identifiers, Self-Service Enterprise Configuration third-party client access, session actor #877 (fern-api[bot])

6.0.0 (2026-07-15)

Full Changelog

⚠️ Breaking Changes

  • ConnectionAttributeIdentifier removed (no compatibility alias); split into three types. The identifier field on each attribute now points to its own type:
    • EmailAttribute.identifier: EmailAttributeIdentifier — {active?, default_method?: DefaultMethodEmailIdentifierEnum} (same shape as the old type; use this as the drop-in replacement).
    • PhoneAttribute.identifier: PhoneAttributeIdentifier — {active?, default_method?: DefaultMethodPhoneNumberIdentifierEnum}.
    • UsernameAttribute.identifier: UsernameAttributeIdentifier — {active?} (no default_method).
  • PhoneProviderProtectionBackoffStrategyEnum: Literal["exponential", "none"] → Literal["exponential", "default"]. Replace the value "none" with "default".
  • ListRolesOffsetPaginatedResponseContent.start / .limit / .total: Optional[float] = None → required float. Deserializing a role-list response missing any of these now raises pydantic.ValidationError.
  • Federated Connections Tokensets removed — the users.federated_connections_tokensets client and its list/delete methods are removed, along with the FederatedConnectionTokenSet and ConnectionFederatedConnectionsAccessTokens types.
  • federated_connections_access_tokens field removed — this optional field is no longer present on ConnectionOptionsAzureAd, ConnectionOptionsCommonOidc, ConnectionOptionsGoogleApps, ConnectionPropertiesOptions, and UpdateConnectionOptions.
  • OAuth scopes removed — read:federated_connections_tokens and delete:federated_connections_tokens are no longer valid values of OauthScope.
  • ClientSessionTransferDelegationDeviceBindingEnum narrowed — the "asn" value is removed; the enum now only accepts "ip".

New Endpoints

  • organizations.roles.members.list(id=..., role_id=...) (sync + async) → GET /api/v2/organizations/{id}/roles/{role_id}/members. New sub-clients organizations.roles and organizations.roles.members; response type ListOrganizationRoleMembersResponseContent, item type RoleMember.

Type Changes/Features

  • Organizations: third_party_client_access: Optional[OrganizationThirdPartyClientAccessEnum] (Literal["block", "allow"]) on create()/update() and all organization response types.
  • Organizations: new types ListOrganizationRoleMembersResponseContent and RoleMember (returned by the role-members endpoint above).
  • Grants: new UserGrant.organization_id: Optional[str] (read-only), via GET /grants.
  • Connections: discovery_url / oidc_metadata extended to samlp connections (previously OIDC-only), via new ConnectionsDiscoveryUrl / ConnectionsOidcMetadata on ConnectionPropertiesOptions and UpdateConnectionOptions.
  • Event Streams: new event-type values connection.created, connection.deleted, connection.updated on EventStreamEventTypeEnum, EventStreamDeliveryEventTypeEnum, EventStreamSubscribeEventsEventTypeEnum, EventStreamTestEventTypeEnum; new EventStreamCloudEventConnection{Created,Deleted,Updated}* payload types; new EventStreamSubscribeEventsResponseContent.
  • Token Vault: new grants: Optional[List[TokenVaultPrivilegedAccessGrant]] on the privileged-access credential/public-key types. TokenVaultPrivilegedAccessGrant: {connection: str, scopes: List[str]}.
  • New error body types: NotFoundErrorBody/NotFoundErrorBodyError, TooManyRequestsErrorBody/TooManyRequestsErrorBodyError.
  • CloudEvent specversion: str → EventStreamCloudEventSpecVersionEnum (Literal["1.0"] + Any fallback) across group/org/user CloudEvent types.
  • NetworkAclMatch — new optional auth0_managed: Optional[List[str]] field (serialized as auth0_managed), available on both the match and not_match rule blocks. This lets network ACL rules reference Auth0-managed lists when matching or excluding traffic.

5.8.0 (2026-06-29)

Full Changelog

⚠️ Breaking Changes

  • clients.update() social/FedCM request types changed — native_social_login and fedcm_login on clients.update() (PATCH /api/v2/clients/{id}) changed from NativeSocialLogin / FedCmLogin to NativeSocialLoginPatch / FedCmLoginPatch. clients.create() still uses the non-patch types, so create and update now require different types for the same logical field. Code passing the old types to update() must switch to the *Patch variants.
  • UserDateSchema removed — user date fields now datetime — the UserDateSchema type (Union[str, Dict[str, Any]]) is deleted and no longer exported from auth0.management.types. created_at, updated_at, last_login, last_password_reset, and multifactor_last_modified on GetUserResponseContent, CreateUserResponseContent, UpdateUserResponseContent, and UserResponseSchema are now Optional[datetime.datetime]. Code that read these as strings/dicts must update.

Type Changes

  • Clients — FedCM / Google One Tap — new fedcm_login (read: FedCmLogin/FedCmLoginGoogle; write: FedCmLoginPatch/FedCmLoginGooglePatch) on create/update/response, gating the Google One Tap prompt in New Universal Login via fedcm_login.google.is_enabled.
  • Clients — Native Social Login patch types — new NativeSocialLoginPatch wrapping apple/facebook/google patch variants (each enabled: Optional[bool]) for clients.update().
  • Clients — Token Vault Privileged Access — new token_vault_privileged_access field on create/update/response, typed ClientTokenVaultPrivilegedAccessWithPublicKey (create) and ClientTokenVaultPrivilegedAccessWithCredentialId (update), each with credentials + ip_allowlist.
  • Connections — Cross App Access — new cross_app_access_requesting_app field (CrossAppAccessRequestingApp{active: bool}) on connections.create()/update(), OIDC/Okta request types, and all connection response types.
  • Identity user_id widened to Union[str, int] — on UserIdentitySchema, UserIdentity, and DeleteUserIdentityResponseContentItem, fixing Pydantic errors on numeric (e.g. GitHub) identity IDs.
  • Email templates — new auth_email_by_code value in EmailTemplateNameEnum.
  • Attack Protection — Phone Provider Protection — new attack_protection.phone_provider_protection sub-client with get() / patch(type=...) (GET/PATCH /attack-protection/phone-provider-protection); new PhoneProviderProtectionBackoffStrategyEnum (exponential/none) and response types.

Bug Fixes

  • 404 handling added across multiple raw clients — keys.signing, organizations (connections, enabled connections, members, member roles), roles.permissions, self_service_profiles.sso_ticket, user_attribute_profiles, and users (connected accounts, organizations, permissions, roles) now raise a typed NotFoundError on 404 instead of an unhandled parse error.
  • add "CustomDomainHeader" to __all__.
  • change CustomDomainHeader return type annotation from Dict[str, Any] to RequestOptions.

5.7.0 (2026-06-10)

Full Changelog

⚠️ Breaking Changes

  • identifiers parameter removed from branding.update(); identifiers field removed from GetBrandingResponseContent and UpdateBrandingResponseContent. The following types are no longer exported from auth0.management.types: BrandingIdentifiers, UpdateBrandingIdentifiers, BrandingPhoneDisplay, UpdateBrandingPhoneDisplay, BrandingLoginDisplayEnum, BrandingPhoneFormattingEnum, BrandingPhoneMaskingEnum, UpdateBrandingLoginDisplayEnum, UpdateBrandingPhoneFormattingEnum, UpdateBrandingPhoneMaskingEnum. These settings now live exclusively on the theme resource (PATCH /api/v2/branding/themes/{id}) #860 (fern-api[bot])
  • id was a required str on PhoneTemplate, GetPhoneTemplateResponseContent, CreatePhoneTemplateResponseContent, UpdatePhoneTemplateResponseContent, and ResetPhoneTemplateResponseContent. It is now Optional[str]. Code that accesses .id without a None check will require updating #860 (fern-api[bot])

Added

  • feat: security_headers (TenantSettingsNullableSecurityHeaders, CSP + XSS protection config), country_codes (TenantSettingsCountryCodesResponse, phone identifier allow/deny list), and include_session_metadata_in_tenant_logs (bool) added to GetTenantSettingsResponseContent and UpdateTenantSettingsResponseContent #860 (fern-api[bot])
  • feat: id_token_session_expiry_supported (ConnectionIdTokenSessionExpirySupported) added to ConnectionOptionsCommonOidc and UpdateConnectionOptions #860 (fern-api[bot])
  • feat: new invitation_landing_client_id Optional field added to ClientMyOrganizationPostConfiguration, ClientMyOrganizationPatchConfiguration, and ClientMyOrganizationResponseConfiguration - available on POST /clients, PATCH /clients/{id}, GET /clients, and GET /clients/{id} #860 (fern-api[bot])

Fixed

  • fix: GET /client-grants/{id}/organizations — added 404 handling; raises NotFoundError when the grant does not exist (was previously an unhandled parse error) #860 (fern-api[bot])
  • fix: PATCH /token-exchange-profiles/{id} — added 409 handling; raises ConflictError when a profile with the same subject_token_type already exists (was previously an unhandled parse error) #860 (fern-api[bot])

5.6.0 (2026-05-28)

Full Changelog

Added

  • feat: rate_limit_policies client with full CRUD: list, create, get, update, delete #853 (fern-api[bot])
  • feat: Response Types: RateLimitPolicyConfigurationZero (allow), RateLimitPolicyConfigurationOne (block/log + limit), RateLimitPolicyConfigurationAction (redirect + limit + redirect_uri), RateLimitPolicy #853 (fern-api[bot])
  • feat: OAuth scopes: create:rate_limit_policies, read:rate_limit_policies, update:rate_limit_policies, delete:rate_limit_policies #853 (fern-api[bot])
  • feat: Support for groups.roles — list, create, delete #853 (fern-api[bot])
  • feat: Support for roles.groups — get, create, delete #853 (fern-api[bot])
  • feat: Support for users.effective_roles / users.effective_roles.sources.groups #853 (fern-api[bot])
  • feat: Support for users.effective_permissions / users.effective_permissions.sources.roles #853 (fern-api[bot])
  • feat: Support for organizations.groups — list #853 (fern-api[bot])
  • feat: Support for organizations.groups.roles — list, create, delete #853 (fern-api[bot])
  • feat: Support for organizations.members.effective_roles / organizations.members.effective_roles.sources.groups #853 (fern-api[bot])
  • feat: Types for SCIM Groups: effective role/permission response types, org-member effective role types, paginated list wrappers, source enum discriminators #853 (fern-api[bot])
  • feat: OAuth scopes: create/read/delete:group_roles, read:organization_groups, create/read/delete:organization_group_roles, read:organization_member_effective_roles, read:organization_member_role_source_groups, read:user_effective_roles, read:user_role_source_groups, read:user_effective_permissions, read:user_permission_source_roles #853 (fern-api[bot])

Changed

  • ConnectionPropertiesOptions — dpop_signing_alg field added (write path for POST /api/v2/connections) #853 (fern-api[bot])
  • UpdateConnectionOptions — dpop_signing_alg field added (write path for PATCH /api/v2/connections/{id}) #853 (fern-api[bot])

5.5.0 (2026-05-20)

Full Changelog

⚠️ Breaking: Python 3.9 support dropped

  • Python 3.9 reached end-of-life in October 2025. This release requires Python >=3.10. Users on Python 3.9 should remain on v5.4.0 until they upgrade their Python version. #843 (developerkunal)

Added

  • feat: configurable max_retries parameter to Auth0 and AsyncAuth0 clients (defaults to 2 with exponential backoff) #841 (fern-api[bot])
  • feat: New error types: BadRequestSchema, ForbiddenSchema, UnauthorizedSchema, TooManyRequestsSchema #841 (fern-api[bot])
  • feat: New types: FedCmLogin, FedCmLoginGoogle, CredentialDeviceTypeEnum #841 (fern-api[bot])
  • Extended user_authentication_method and resource_server response types with additional fields #841 (fern-api[bot])
  • Expanded clients, refresh_tokens, resource_servers, tickets, and users/authentication_methods endpoint parameters

Changed

5.4.0 (2026-05-04)

Full Changelog

Added

  • chore: Add events module, async token support, and connection retry resilience #835 (fern-api[bot])

Changed

Fixed

5.3.0 (2026-04-09)

Full Changelog

Added

  • feat: Add CIMD support, organization connections, group deletion, refresh token listing; remove AOL/Flickr/Yammer providers #816 (fern-api[bot])
  • feat:Add Auth0-Custom-Domain header support for Multiple Custom Domains (MCD) #799 (kishore7snehil)

5.2.0 (2026-03-30)

Full Changelog

⚠️ Breaking: Python 3.8 support dropped

  • Python 3.8 reached end-of-life in October 2024. This release requires Python >=3.9.2. Users on Python 3.8 should remain on v5.1.0 until they upgrade their Python version. #808 (kishore7snehil)

Added

  • feat: Add default domain endpoints, connection key provisioning, tenant SCIM listing; remove MiiCard/Renren providers #801 (fern-api[bot])
  • feat: Add client_info support for custom telemetry in Authentication and Management clients #802 (kishore7snehil)
  • feat: Add SDK logging infrastructure with configurable log levels and header redaction #785 (fern-api[bot])

Fixed

Changed

  • chore: Update ruff, aiohttp, cryptography, urllib3, codecov-action; replace Snyk with SCA scan #808 (kishore7snehil)

5.1.0 (2026-02-11)

Full Changelog

Fixed

  • fix: Remove placeholder defaults from optional parameters + additional updates #778 (fern-api[bot])

5.0.0 (2026-02-04)

Full Changelog

📢 This is the official v5.0.0 release with significant improvements and breaking changes.

Breaking Changes

  • Complete rewrite of Management API client - Generated from Auth0's OpenAPI specifications using Fern
  • Python 3.7 support dropped - Minimum required version is now Python 3.8
  • Management API client restructured - Methods organized into modular sub-clients for better discoverability
  • Method signatures changed - Consistent and predictable naming conventions across all endpoints
  • Response types changed - Strongly-typed Pydantic models replace generic dictionaries
  • Import paths changed - from auth0.management.core.api_error import ApiError instead of from auth0.exceptions import Auth0Error
  • Pagination defaults changed - include_totals=True is now the default for list operations
  • Client initialization simplified - ManagementClient takes domain instead of full base_url

Added

  • First-class async support with AsyncAuth0 and AsyncManagementClient
  • Automatic token management with client credentials in ManagementClient
  • Built-in pagination support with include_totals=True by default
  • Type-safe request/response objects using Pydantic models
  • Better IntelliSense and code completion support
  • Comprehensive API reference documentation
  • Migration guide for upgrading from v4.x

Changed

  • Management API client fully regenerated using Fern
  • Package structure reorganized with hierarchical sub-clients
  • Error handling updated to use ApiError base class
  • Documentation updated with v5 examples

Note

  • Authentication API remains fully backward compatible - no changes required
  • See v5_MIGRATION_GUIDE.md for detailed upgrade instructions

4.13.0 (2025-09-17)

Full Changelog

Added

  • fix(backchannel): expose headers on slow_down errors (HTTP 429s) #744 (pmalouin)

4.12.0 (2025-09-15)

Full Changelog

Added

4.11.0 (2025-09-11)

Full Changelog

Added

Fixed

4.10.0 (2025-06-05)

Full Changelog

Added

  • chore: merge community PRs – bugfixes, features, and dependency upgrades #696 (kishore7snehil)

Fixed

4.9.0 (2025-04-01)

Full Changelog

Added

4.8.1 (2025-02-24)

Full Changelog

Fixed

4.8.0 (2025-01-29)

Full Changelog

Added

Fixed

4.7.2 (2024-09-10)

Full Changelog

Security

4.7.1 (2024-02-26)

Full Changelog

Security

4.7.0 (2023-12-05)

Full Changelog

⚠️ BREAKING CHANGES

Added

  • [SDK-4138] Add support for Pushed Authorization Requests (PAR) #560 (adamjmcgrath)

4.6.1 (2023-11-29)

Full Changelog

Fixed

4.6.0 (2023-11-09)

Full Changelog

Added

  • [SDK-4544] Add orgs in client credentials support #549 (adamjmcgrath)
  • Authentication API, the Database classs, Add the organization param to the change_password method #539 (shchotse)
  • Retry all methods on 429 #518 (adamjmcgrath)

4.5.0 (2023-10-20)

Full Changelog

Added

4.4.2 (2023-08-31)

Full Changelog

Fixed

4.4.1 (2023-08-21)

Full Changelog

Fixed

4.4.0 (2023-07-25)

Full Changelog

Added

Fixed

  • Fix asyncify for users client where token is not required #506 (cgearing)

4.3.0 (2023-06-26)

Full Changelog

Added

Fixed

4.2.0 (2023-05-02)

Full Changelog

Added

  • Add cache_ttl param to AsymmetricSignatureVerifier #490 (matei-radu)

4.1.1 (2023-04-13)

Full Changelog

Fixed

4.1.0 (2023-03-14)

Full Changelog

Added

4.0.0 (2023-01-19)

Full Changelog

Added

Security

Changed

⚠️ BREAKING CHANGES

See the V4_MIGRATION_GUIDE for more info.

3.24.1 (2023-01-19)

Full Changelog

Fixed

  • Remove unnecessary type param from update_template_universal_login #463 (adamjmcgrath)

3.24.0 (2022-10-17)

Full Changelog

Added

Fixed

3.23.1 (2022-06-10)

Full Changelog

Fixed

3.23.0

Added

3.22.0

Added

  • [SDK-3174] Add DELETE method for /api/v2/users/{id}/authenticators endpoint #301 (akmjenkins)
  • [SDK-3175] Return token claims in TokenVerifier.verify() #273 (bisguzar)

Fixed

  • [SDK-3173] Default to 'None' for deployed on GET /api/v2/actions/actions endpoint #309 (evansims)

3.21.0

Added

3.20.0

Added

3.19.0

Added

Changed

  • Remove references to ID token in generic token classes #295 (lbalmaceda)

Fixed

  • Use assertNotEqual instead of assertNotEquals for Python 3.11 compatibility. #294 (tirkarthi)

3.18.0

Added

3.17.0

Added

  • Make the CI fail when the docs syntax is invalid #287 (lbalmaceda)
  • [SDK-2687] Implement automatic rate-limit handling #285 (evansims)
  • Use Sphinx to generate API docs #281 (lbalmaceda)
  • Add Passwordless Login function #279 (lbalmaceda)
  • [SDK 2665] Update endpoint methods to support 'from' and 'take' checkpoint pagination parameters, where appropriate #278 (evansims)

Deprecated

3.16.2

Fixed

3.16.1

Fixed

3.16.0

Added

3.15.0

Added

3.14.0

Added

  • Adds a new user method invalidate_remembered_browsers #248 (kpurdon)

3.13.0

Added

Fixed

3.12.0

Added

  • Add missing user profile properties to the signup endpoint #231 (lbalmaceda)
  • Add Hooks management API #227 (guillp)
  • Add missing external_id property to the import users job #222 (lbalmaceda)

Changed

Fixed

  • Skip sending optional parameters on POST request when unspecified #230 (lbalmaceda)

3.11.0

Added

Removed

  • Add deprecation note for DELETE /users (all users) #217 (lbalmaceda)

3.10.0

Security

Added

3.9.2

Fixed

3.9.1

Changed

3.9.0

Added

3.8.1

July 18, 2019: This release included an unintentionally breaking change affecting those users that were manually parsing the response from GET requests. e.g. /userinfo or /authorize. The AuthenticationBase#get method was incorrectly parsing the request result into a String.

From this release on, making a GET request returns a Dictionary instead.

Breaking Change

  • Fix request creation when headers are the default #198 (lbalmaceda).

3.8.0

Fixed

Security

3.7.2

Fixed

3.7.1

Fixed

3.7.0

Changed

3.6.1

Fixed

  • Fixed Management API Grants class instantiation #179 (beck3905)

3.6.0

Added

  • Add grants, custom domains, rules_configs to API #177 (sagnew-dg)

3.5.0

Added

3.4.0

Added

  • Add client_id param to ClientGrants.all #159 (danishprakash)
  • Add telemetry headers to AuthenticationBase #152 (crgk)
  • Add pre-commit pypgrade hook and update supported versions #124 (hugovk)
  • Implemented delete_user_by_email and test for connections #122 (runz0rd)
  • Adds user export job creation. #112 (dmark)

Changed

  • String Formatting Updated #141 (vkmrishad)
  • Uses Python built-in modules to retrieve Python and auth0-python version number #125 (edawine)

Fixed

  • Stop lower-casing email on user search #167 (helmus)
  • Always include Content-Type header in management requests #158 (crgk)

3.3.0

Added

  • Add pagination to Clients and Connections
  • Add pagination to Client Grants, Resource Servers and Rules
  • Add Email-Templates Management API endpoints

Fixed

  • Replace default mutable arguments with None
  • Fix JSON error message handling for Management API

3.2.2

Fixed

  • Upload the correct package contents to Pypi.

3.2.0

Added

Fixed

  • Correctly throw an exception when handing a text response #92 (benbc)
  • Instantiate UserBlocks for consistency #90 (mattdodge)

3.1.4

Authentication API

  • Improve handling of inconsistent API error responses.

3.1.3

Management API

  • Added upsert parameter to import_users job.

3.1.2

Authentication API

  • Added refresh_token method to get_token

3.1.0

Authentication API

  • Added Logout Functionality

3.0.0

Authentication API

  • Added Support for API Authorization. oauth/token endpoint
    • Client Credentials Grant
    • Authorization Code Grant
    • Authorization Code PKCE Grant
    • Resource Owner Password Realm Grant
  • Added Support for API Authorization. authorize endpoint
    • Authorization Code Grant

Management API v2

  • Added Support for Guardian
  • Added Support to retrieve Logs
  • Added Support to manage Resource Servers
  • Added Support to manage Client Grants
  • Added Support to manage User blocks