workos 3.4.1

// This file is auto-generated by oagen. Do not edit.

use crate::client::Client;
#[allow(unused_imports)]
use crate::enums::*;
use crate::error::Error;
#[allow(unused_imports)]
use crate::models::*;
use serde::Serialize;

pub struct SSOApi<'a> {
    pub(crate) client: &'a Client,
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(untagged)]
pub enum CreateProtocolOptions {
    SAML {
        saml_options: CreateConnectionSAMLOptions,
    },
    Oidc {
        oidc_options: CreateConnectionOidcOptions,
    },
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
#[serde(untagged)]
pub enum PatchProtocolOptions {
    SAML {
        saml_options: PatchConnectionSAMLOptions,
    },
    Oidc {
        oidc_options: PatchConnectionOidcOptions,
    },
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
pub struct CreateConnectionParamsBody {
    /// Unique identifier for the Organization in which the Connection resides.
    ///
    /// Required.
    pub organization_id: String,
    /// A human-readable name for the Connection. This will most commonly be the organization's name.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The customer-owned identifier for the Connection.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub external_id: Option<String>,
    /// The type of the Connection. Only SAML and OIDC connection types may be created. When omitted, the type is inferred from the provided options.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub connection_type: Option<String>,
    /// How IdP attributes or claims map onto WorkOS profile fields. Provided fields override the defaults for the connection type.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub attribute_maps: Option<CreateConnectionAttributeMaps>,
    #[serde(flatten)]
    pub protocol_options: CreateProtocolOptions,
}

impl CreateConnectionParamsBody {
    /// Construct a new `CreateConnectionParamsBody` with the required fields set.
    pub fn new(
        organization_id: impl Into<String>,
        protocol_options: CreateProtocolOptions,
    ) -> Self {
        Self {
            organization_id: organization_id.into(),
            name: Default::default(),
            external_id: Default::default(),
            connection_type: Default::default(),
            attribute_maps: Default::default(),
            protocol_options,
        }
    }
}

#[derive(Debug, Clone, serde::Serialize, serde::Deserialize, Default)]
pub struct UpdateConnectionParamsBody {
    /// A human-readable name for the Connection.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The customer-owned identifier for the Connection. Set to `null` to stop tracking one.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub external_id: Option<String>,
    /// The type of the Connection. Immutable after creation — it may be sent, but only with the Connection current type.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub connection_type: Option<String>,
    /// How IdP attributes or claims map onto WorkOS profile fields. Only the provided fields are updated.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub attribute_maps: Option<PatchConnectionAttributeMaps>,
    #[serde(flatten)]
    #[serde(skip_serializing_if = "Option::is_none")]
    pub protocol_options: Option<PatchProtocolOptions>,
}

impl UpdateConnectionParamsBody {
    /// Construct a new `UpdateConnectionParamsBody` with the required fields set.
    pub fn new() -> Self {
        Self {
            name: Default::default(),
            external_id: Default::default(),
            connection_type: Default::default(),
            attribute_maps: Default::default(),
            protocol_options: Default::default(),
        }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct ListConnectionsParams {
    /// An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub before: Option<String>,
    /// An object ID that defines your place in the list. When the ID is not present, you are at the end of the list.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub after: Option<String>,
    /// Upper limit on the number of objects to return, between `1` and `100`.
    ///
    /// Defaults to `10`.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub limit: Option<i64>,
    /// Order the results by the creation time.
    ///
    /// Defaults to `desc`.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub order: Option<PaginationOrder>,
    /// Filter Connections by their type.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub connection_type: Option<ConnectionsConnectionType>,
    /// Filter Connections by their associated domain.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub domain: Option<String>,
    /// Filter Connections by their associated organization.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub organization_id: Option<String>,
    /// Searchable text to match against Connection names.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub search: Option<String>,
}

impl Default for ListConnectionsParams {
    #[allow(deprecated)]
    fn default() -> Self {
        Self {
            before: Default::default(),
            after: Default::default(),
            limit: Some(10),
            order: Some(PaginationOrder::Desc),
            connection_type: Default::default(),
            domain: Default::default(),
            organization_id: Default::default(),
            search: Default::default(),
        }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct CreateConnectionParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: CreateConnectionParamsBody,
}

impl CreateConnectionParams {
    /// Construct a new `CreateConnectionParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: CreateConnectionParamsBody) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct CreateConnectionSAMLIdpSigningCertParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: CreateSAMLIdpSigningCertificate,
}

impl CreateConnectionSAMLIdpSigningCertParams {
    /// Construct a new `CreateConnectionSAMLIdpSigningCertParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: CreateSAMLIdpSigningCertificate) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct UpdateConnectionParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: UpdateConnectionParamsBody,
}

impl UpdateConnectionParams {
    /// Construct a new `UpdateConnectionParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: UpdateConnectionParamsBody) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct GetAuthorizationUrlParams {
    /// Additional scopes to request from the identity provider. Applicable when using OAuth or OpenID Connect connections.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[serde(serialize_with = "crate::query::serialize_comma_separated_opt")]
    pub provider_scopes: Option<Vec<String>>,
    /// Key/value pairs of query parameters to pass to the OAuth provider. Only applicable when using OAuth connections.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub provider_query_params: Option<std::collections::HashMap<String, String>>,
    /// Deprecated. Use `connection` or `organization` instead. Used to initiate SSO for a connection by domain. The domain must be associated with a connection in your WorkOS environment.
    #[serde(skip_serializing_if = "Option::is_none")]
    #[deprecated]
    pub domain: Option<String>,
    /// Used to initiate OAuth authentication with various providers.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub provider: Option<SSOProvider>,
    /// Where to redirect the user after they complete the authentication process. You must use one of the redirect URIs configured via the [Redirects](https://dashboard.workos.com/redirects) page on the dashboard.
    ///
    /// Required.
    pub redirect_uri: String,
    /// An optional parameter that can be used to encode arbitrary information to help restore application state between redirects. If included, the redirect URI received from WorkOS will contain the exact `state` that was passed.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub state: Option<String>,
    /// Used to initiate SSO for a connection. The value should be a WorkOS connection ID.
    /// You can persist the WorkOS connection ID with application user or team identifiers. WorkOS will use the connection indicated by the connection parameter to direct the user to the corresponding IdP for authentication.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub connection: Option<String>,
    /// Used to initiate SSO for an organization. The value should be a WorkOS organization ID.
    /// You can persist the WorkOS organization ID with application user or team identifiers. WorkOS will use the organization ID to determine the appropriate connection and the IdP to direct the user to for authentication.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub organization: Option<String>,
    /// Can be used to pre-fill the domain field when initiating authentication with Microsoft OAuth or with a Google SAML connection type.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub domain_hint: Option<String>,
    /// Can be used to pre-fill the username/email address field of the IdP sign-in page for the user, if you know their username ahead of time. Currently supported for OAuth, OpenID Connect, Okta, Entra ID, and custom SAML connections.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub login_hint: Option<String>,
    /// A random string generated by the client that is used to mitigate replay attacks.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub nonce: Option<String>,
    /// If set to `login`, forces re-authentication at the identity provider. For supported SAML providers this sets `ForceAuthn="true"` in the SAML request; providers that don't support it are unaffected.
    #[serde(skip_serializing_if = "Option::is_none")]
    pub prompt: Option<String>,
}

impl GetAuthorizationUrlParams {
    /// Construct a new `GetAuthorizationUrlParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(redirect_uri: impl Into<String>) -> Self {
        Self {
            provider_scopes: Default::default(),
            provider_query_params: Default::default(),
            domain: Default::default(),
            provider: Default::default(),
            redirect_uri: redirect_uri.into(),
            state: Default::default(),
            connection: Default::default(),
            organization: Default::default(),
            domain_hint: Default::default(),
            login_hint: Default::default(),
            nonce: Default::default(),
            prompt: Default::default(),
        }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct GetLogoutUrlParams {
    /// The logout token returned from the [Logout Authorize](https://workos.com/docs/reference/sso/logout/authorize) endpoint.
    ///
    /// Required.
    pub token: crate::SecretString,
}

impl GetLogoutUrlParams {
    /// Construct a new `GetLogoutUrlParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(token: impl Into<crate::SecretString>) -> Self {
        Self {
            token: token.into(),
        }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct AuthorizeLogoutParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: SSOLogoutAuthorizeRequest,
}

impl AuthorizeLogoutParams {
    /// Construct a new `AuthorizeLogoutParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: SSOLogoutAuthorizeRequest) -> Self {
        Self { body }
    }
}

#[derive(Debug, Clone, Serialize)]
pub struct GetProfileAndTokenParams {
    /// Request body sent with this call.
    ///
    /// Required.
    #[serde(skip)]
    pub body: TokenQuery,
}

impl GetProfileAndTokenParams {
    /// Construct a new `GetProfileAndTokenParams` with the required fields set.
    #[allow(deprecated)]
    pub fn new(body: TokenQuery) -> Self {
        Self { body }
    }
}

impl<'a> SSOApi<'a> {
    /// List Connections
    ///
    /// Get a list of all of your existing connections matching the criteria specified.
    pub async fn list_connections(
        &self,
        params: ListConnectionsParams,
    ) -> Result<ConnectionList, Error> {
        self.list_connections_with_options(params, None).await
    }

    /// Variant of [`Self::list_connections`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_connections_with_options(
        &self,
        params: ListConnectionsParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<ConnectionList, Error> {
        let path = "/connections".to_string();
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &params, options)
            .await
    }

    /// Returns an async [`futures_util::Stream`] that yields every `Connection`
    /// across all pages, advancing the `after` cursor under the hood.
    ///
    /// ```ignore
    /// use futures_util::TryStreamExt;
    /// let all: Vec<Connection> = self
    ///     .list_connections_auto_paging(params)
    ///     .try_collect()
    ///     .await?;
    /// ```
    pub fn list_connections_auto_paging(
        &self,
        params: ListConnectionsParams,
    ) -> impl futures_util::Stream<Item = Result<Connection, Error>> + '_ {
        crate::pagination::auto_paginate_pages(move |after| {
            let mut params = params.clone();
            params.after = after;
            async move {
                let page = self.list_connections(params).await?;
                Ok((page.data, page.list_metadata.after))
            }
        })
    }

    /// Create a Connection
    ///
    /// Creates a new connection for an organization. Provide `saml_options` or `oidc_options` to configure the identity provider. When `external_id` matches an existing connection in the organization, that connection is returned instead of creating a duplicate.
    pub async fn create_connection(
        &self,
        params: CreateConnectionParams,
    ) -> Result<Connection, Error> {
        self.create_connection_with_options(params, None).await
    }

    /// Variant of [`Self::create_connection`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_connection_with_options(
        &self,
        params: CreateConnectionParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<Connection, Error> {
        let path = "/connections".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// List IdP signing certificates
    ///
    /// Lists every Identity Provider signing certificate on the connection, including expired ones, oldest first.
    pub async fn list_connection_saml_idp_signing_certs(
        &self,
        connection_id: &str,
    ) -> Result<SAMLIdpSigningCertificateList, Error> {
        self.list_connection_saml_idp_signing_certs_with_options(connection_id, None)
            .await
    }

    /// Variant of [`Self::list_connection_saml_idp_signing_certs`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_connection_saml_idp_signing_certs_with_options(
        &self,
        connection_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SAMLIdpSigningCertificateList, Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let path = format!("/connections/{connection_id}/saml_idp_signing_certs");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Create an IdP signing certificate
    ///
    /// Adds an Identity Provider signing certificate to the connection, so SAML responses signed with its key can be verified. Use this to import a new certificate ahead of an Identity Provider rotation — the existing certificates keep working until they are deleted or expire.
    pub async fn create_connection_saml_idp_signing_cert(
        &self,
        connection_id: &str,
        params: CreateConnectionSAMLIdpSigningCertParams,
    ) -> Result<SAMLIdpSigningCertificate, Error> {
        self.create_connection_saml_idp_signing_cert_with_options(connection_id, params, None)
            .await
    }

    /// Variant of [`Self::create_connection_saml_idp_signing_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_connection_saml_idp_signing_cert_with_options(
        &self,
        connection_id: &str,
        params: CreateConnectionSAMLIdpSigningCertParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SAMLIdpSigningCertificate, Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let path = format!("/connections/{connection_id}/saml_idp_signing_certs");
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Delete an IdP signing certificate
    ///
    /// Removes an Identity Provider signing certificate from the connection. The last remaining certificate cannot be deleted. A certificate still published in the Identity Provider metadata may be restored by a metadata refresh.
    pub async fn delete_connection_saml_idp_signing_cert(
        &self,
        connection_id: &str,
        certificate_id: &str,
    ) -> Result<(), Error> {
        self.delete_connection_saml_idp_signing_cert_with_options(
            connection_id,
            certificate_id,
            None,
        )
        .await
    }

    /// Variant of [`Self::delete_connection_saml_idp_signing_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn delete_connection_saml_idp_signing_cert_with_options(
        &self,
        connection_id: &str,
        certificate_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<(), Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let certificate_id = crate::client::path_segment(certificate_id);
        let path = format!("/connections/{connection_id}/saml_idp_signing_certs/{certificate_id}");
        let method = http::Method::DELETE;
        self.client
            .request_with_query_opts_empty(method, &path, &(), options)
            .await
    }

    /// List SP encryption certificates
    ///
    /// Lists the public certificates the Identity Provider can use to encrypt SAML responses sent to WorkOS, including expired ones, oldest first.
    pub async fn list_connection_saml_sp_encryption_certs(
        &self,
        connection_id: &str,
    ) -> Result<SAMLSpEncryptionCertificateList, Error> {
        self.list_connection_saml_sp_encryption_certs_with_options(connection_id, None)
            .await
    }

    /// Variant of [`Self::list_connection_saml_sp_encryption_certs`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_connection_saml_sp_encryption_certs_with_options(
        &self,
        connection_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SAMLSpEncryptionCertificateList, Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let path = format!("/connections/{connection_id}/saml_sp_encryption_certs");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Create an SP encryption certificate
    ///
    /// Generates a new encryption key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pairs, provide `saml_options.sp_encryption_key_pairs` when creating the connection instead. Creating a certificate appends rather than replaces: every active private key is tried when decrypting, which lets a rotation overlap the old and new certificates.
    pub async fn create_connection_saml_sp_encryption_cert(
        &self,
        connection_id: &str,
    ) -> Result<SAMLSpEncryptionCertificate, Error> {
        self.create_connection_saml_sp_encryption_cert_with_options(connection_id, None)
            .await
    }

    /// Variant of [`Self::create_connection_saml_sp_encryption_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_connection_saml_sp_encryption_cert_with_options(
        &self,
        connection_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SAMLSpEncryptionCertificate, Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let path = format!("/connections/{connection_id}/saml_sp_encryption_certs");
        let method = http::Method::POST;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Delete an SP encryption certificate
    ///
    /// Removes an encryption key pair from the connection. SAML responses encrypted with its certificate can no longer be decrypted, so remove the certificate from the Identity Provider first when rotating.
    pub async fn delete_connection_saml_sp_encryption_cert(
        &self,
        connection_id: &str,
        certificate_id: &str,
    ) -> Result<(), Error> {
        self.delete_connection_saml_sp_encryption_cert_with_options(
            connection_id,
            certificate_id,
            None,
        )
        .await
    }

    /// Variant of [`Self::delete_connection_saml_sp_encryption_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn delete_connection_saml_sp_encryption_cert_with_options(
        &self,
        connection_id: &str,
        certificate_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<(), Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let certificate_id = crate::client::path_segment(certificate_id);
        let path =
            format!("/connections/{connection_id}/saml_sp_encryption_certs/{certificate_id}");
        let method = http::Method::DELETE;
        self.client
            .request_with_query_opts_empty(method, &path, &(), options)
            .await
    }

    /// Get the SP signing certificate
    ///
    /// Returns the public certificate the Identity Provider can use to verify the signature of SAML requests sent by WorkOS. Responds with `404` when the connection has no request signing key pair.
    pub async fn list_connection_saml_sp_signing_cert(
        &self,
        connection_id: &str,
    ) -> Result<SAMLSpSigningCertificate, Error> {
        self.list_connection_saml_sp_signing_cert_with_options(connection_id, None)
            .await
    }

    /// Variant of [`Self::list_connection_saml_sp_signing_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn list_connection_saml_sp_signing_cert_with_options(
        &self,
        connection_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SAMLSpSigningCertificate, Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let path = format!("/connections/{connection_id}/saml_sp_signing_cert");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Create an SP signing certificate
    ///
    /// Generates a new request signing key pair for the connection and returns its public certificate. WorkOS holds the private key, so the request takes no body — to bring your own key pair, provide `saml_options.sp_signing_key_pair` when creating the connection instead. A connection signs with one key pair at a time: delete the existing certificate before creating its replacement.
    pub async fn create_connection_saml_sp_signing_cert(
        &self,
        connection_id: &str,
    ) -> Result<SAMLSpSigningCertificate, Error> {
        self.create_connection_saml_sp_signing_cert_with_options(connection_id, None)
            .await
    }

    /// Variant of [`Self::create_connection_saml_sp_signing_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn create_connection_saml_sp_signing_cert_with_options(
        &self,
        connection_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SAMLSpSigningCertificate, Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let path = format!("/connections/{connection_id}/saml_sp_signing_cert");
        let method = http::Method::POST;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Delete the SP signing certificate
    ///
    /// Removes the request signing key pair from the connection, after which SAML requests are sent unsigned. Delete the certificate before creating its replacement when rotating.
    pub async fn delete_connection_saml_sp_signing_cert(
        &self,
        connection_id: &str,
        certificate_id: &str,
    ) -> Result<(), Error> {
        self.delete_connection_saml_sp_signing_cert_with_options(
            connection_id,
            certificate_id,
            None,
        )
        .await
    }

    /// Variant of [`Self::delete_connection_saml_sp_signing_cert`] that accepts per-request [`crate::RequestOptions`].
    pub async fn delete_connection_saml_sp_signing_cert_with_options(
        &self,
        connection_id: &str,
        certificate_id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<(), Error> {
        let connection_id = crate::client::path_segment(connection_id);
        let certificate_id = crate::client::path_segment(certificate_id);
        let path = format!("/connections/{connection_id}/saml_sp_signing_cert/{certificate_id}");
        let method = http::Method::DELETE;
        self.client
            .request_with_query_opts_empty(method, &path, &(), options)
            .await
    }

    /// Get a Connection
    ///
    /// Get the details of an existing connection.
    pub async fn get_connection(&self, id: &str) -> Result<Connection, Error> {
        self.get_connection_with_options(id, None).await
    }

    /// Variant of [`Self::get_connection`] that accepts per-request [`crate::RequestOptions`].
    pub async fn get_connection_with_options(
        &self,
        id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<Connection, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/connections/{id}");
        let method = http::Method::GET;
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Update a Connection
    ///
    /// Updates an existing connection. Only the provided fields are changed; fields that accept `null` are reset to their default behavior.
    pub async fn update_connection(
        &self,
        id: &str,
        params: UpdateConnectionParams,
    ) -> Result<Connection, Error> {
        self.update_connection_with_options(id, params, None).await
    }

    /// Variant of [`Self::update_connection`] that accepts per-request [`crate::RequestOptions`].
    pub async fn update_connection_with_options(
        &self,
        id: &str,
        params: UpdateConnectionParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<Connection, Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/connections/{id}");
        let method = http::Method::PATCH;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Delete a Connection
    ///
    /// Permanently deletes an existing connection. It cannot be undone.
    pub async fn delete_connection(&self, id: &str) -> Result<(), Error> {
        self.delete_connection_with_options(id, None).await
    }

    /// Variant of [`Self::delete_connection`] that accepts per-request [`crate::RequestOptions`].
    pub async fn delete_connection_with_options(
        &self,
        id: &str,
        options: Option<&crate::RequestOptions>,
    ) -> Result<(), Error> {
        let id = crate::client::path_segment(id);
        let path = format!("/connections/{id}");
        let method = http::Method::DELETE;
        self.client
            .request_with_query_opts_empty(method, &path, &(), options)
            .await
    }

    /// Initiate SSO
    ///
    /// Initiates the single sign-on flow.
    pub fn get_authorization_url(
        &self,
        params: GetAuthorizationUrlParams,
    ) -> Result<String, Error> {
        let path = "/sso/authorize".to_string();
        let mut overlay = serde_json::Map::new();
        overlay.insert("response_type".to_string(), serde_json::json!("code"));
        overlay.insert(
            "client_id".to_string(),
            serde_json::Value::String(self.client.client_id().to_string()),
        );
        let params_value = serde_json::to_value(&params)
            .map_err(|e| Error::Builder(format!("query encode failed: {e}")))?;
        if let serde_json::Value::Object(map) = params_value {
            for (k, v) in map {
                overlay.insert(k, v);
            }
        }
        let merged = serde_json::Value::Object(overlay);
        let qs = crate::query::encode_query(&merged)?;
        let url = if qs.is_empty() {
            format!("{}{}", self.client.base_url(), path)
        } else {
            format!("{}{}?{}", self.client.base_url(), path, qs)
        };
        Ok(url)
    }

    /// Logout Redirect
    ///
    /// Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This `GET` endpoint should be a redirection, since the identity provider user will be identified in the browser session.
    ///
    /// Before redirecting to this endpoint, you need to generate a short-lived logout token using the [Logout Authorize](https://workos.com/docs/reference/sso/logout/authorize) endpoint.
    pub fn get_logout_url(&self, params: GetLogoutUrlParams) -> Result<String, Error> {
        let path = "/sso/logout".to_string();
        let qs = crate::query::encode_query(&params)?;
        let url = if qs.is_empty() {
            format!("{}{}", self.client.base_url(), path)
        } else {
            format!("{}{}?{}", self.client.base_url(), path, qs)
        };
        Ok(url)
    }

    /// Logout Authorize
    ///
    /// You should call this endpoint from your server to generate a logout token which is required for the [Logout Redirect](https://workos.com/docs/reference/sso/logout) endpoint.
    pub async fn authorize_logout(
        &self,
        params: AuthorizeLogoutParams,
    ) -> Result<SSOLogoutAuthorizeResponse, Error> {
        self.authorize_logout_with_options(params, None).await
    }

    /// Variant of [`Self::authorize_logout`] that accepts per-request [`crate::RequestOptions`].
    pub async fn authorize_logout_with_options(
        &self,
        params: AuthorizeLogoutParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SSOLogoutAuthorizeResponse, Error> {
        let path = "/sso/logout/authorize".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }

    /// Get a User Profile
    ///
    /// Exchange an access token for a user's [Profile](https://workos.com/docs/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](https://workos.com/docs/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.
    pub async fn get_profile(&self, access_token: impl Into<String>) -> Result<Profile, Error> {
        self.get_profile_with_options(access_token, None).await
    }

    /// Variant of [`Self::get_profile`] that accepts per-request [`crate::RequestOptions`].
    pub async fn get_profile_with_options(
        &self,
        access_token: impl Into<String>,
        options: Option<&crate::RequestOptions>,
    ) -> Result<Profile, Error> {
        let path = "/sso/profile".to_string();
        let method = http::Method::GET;
        let access_token: String = access_token.into();
        let auth = http::HeaderValue::from_str(&format!("Bearer {access_token}"))
            .map_err(|e| Error::Builder(format!("invalid bearer token: {e}")))?;
        let mut merged = options.cloned().unwrap_or_default();
        merged
            .extra_headers
            .push((http::header::AUTHORIZATION, auth));
        let options = Some(&merged);
        self.client
            .request_with_query_opts(method, &path, &(), options)
            .await
    }

    /// Get a Profile and Token
    ///
    /// Get an access token along with the user [Profile](https://workos.com/docs/reference/sso/profile) using the code passed to your [Redirect URI](https://workos.com/docs/reference/sso/get-authorization-url/redirect-uri).
    pub async fn get_profile_and_token(
        &self,
        params: GetProfileAndTokenParams,
    ) -> Result<SSOTokenResponse, Error> {
        self.get_profile_and_token_with_options(params, None).await
    }

    /// Variant of [`Self::get_profile_and_token`] that accepts per-request [`crate::RequestOptions`].
    pub async fn get_profile_and_token_with_options(
        &self,
        params: GetProfileAndTokenParams,
        options: Option<&crate::RequestOptions>,
    ) -> Result<SSOTokenResponse, Error> {
        let path = "/sso/token".to_string();
        let method = http::Method::POST;
        self.client
            .request_with_body_opts(method, &path, &params, Some(&params.body), options)
            .await
    }
}