From 1fd6f0f6fc1dc57ab4c7b8633441164b7c1a34cf Mon Sep 17 00:00:00 2001
From: "workos-sdk-automation[bot]"
 <255426317+workos-sdk-automation[bot]@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:24:06 +0000
Subject: [PATCH] Update OpenAPI spec from
 workos/workos@3a8ccd2466bc01294ef6a412d98863f8dd68dd43

---
 .last-synced-sha        |  2 +-
 spec/open-api-spec.yaml | 74 ++++++++++++++++++++++-------------------
 2 files changed, 41 insertions(+), 35 deletions(-)

diff --git a/.last-synced-sha b/.last-synced-sha
index a8fe351..4cc0201 100644
--- a/.last-synced-sha
+++ b/.last-synced-sha
@@ -1 +1 @@
-f0d19381b1dc3e3616d978049deca90ea0332ee3
+3a8ccd2466bc01294ef6a412d98863f8dd68dd43
diff --git a/spec/open-api-spec.yaml b/spec/open-api-spec.yaml
index 5d660aa..a1ef717 100644
--- a/spec/open-api-spec.yaml
+++ b/spec/open-api-spec.yaml
@@ -35908,40 +35908,46 @@ components:
           example:
             - oauth
         credentials:
-          type: object
-          properties:
-            type:
-              type: string
-              enum:
-                - custom
-                - organization
-              description: >-
-                The credentials type. `custom` uses your own OAuth app
-                credentials; `organization` has each organization supply its own
-                credentials (so `client_id`/`redacted_client_secret` are null on
-                the integration itself).
-              example: custom
-            client_id:
-              type:
-                - string
-                - 'null'
-              description: >-
-                The OAuth client ID configured for the provider app. Null for
-                `organization` credentials.
-              example: Iv1.abc123
-            redacted_client_secret:
-              type:
-                - string
-                - 'null'
-              description: >-
-                The last four characters of the OAuth client secret. The full
-                secret is never returned. Null for `organization` credentials.
-              example: '6789'
-          required:
-            - type
-            - client_id
-            - redacted_client_secret
-          description: The credentials configured for the Data Integration.
+          description: >-
+            The integration-level OAuth app credentials. `null` for `api_key`
+            integrations, which hold no OAuth credentials (keys are installed
+            per-tenant).
+          oneOf:
+            - type: object
+              properties:
+                type:
+                  type: string
+                  enum:
+                    - custom
+                    - organization
+                  description: >-
+                    The credentials type. `custom` uses your own OAuth app
+                    credentials; `organization` has each organization supply its
+                    own credentials (so `client_id`/`redacted_client_secret` are
+                    null on the integration itself).
+                  example: custom
+                client_id:
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The OAuth client ID configured for the provider app. Null
+                    for `organization` credentials.
+                  example: Iv1.abc123
+                redacted_client_secret:
+                  type:
+                    - string
+                    - 'null'
+                  description: >-
+                    The last four characters of the OAuth client secret. The
+                    full secret is never returned. Null for `organization`
+                    credentials.
+                  example: '6789'
+              required:
+                - type
+                - client_id
+                - redacted_client_secret
+            - type: 'null'
         installation:
           description: >-
             The tenant installation created when an API key was supplied at