Skip to content

CHANGELOG.md

Latest commit

 

History

History
709 lines (497 loc) · 44.9 KB

CHANGELOG.md

File metadata and controls

709 lines (497 loc) · 44.9 KB
Raw

Change Log

6.1.0 (2026-07-22)

Full Changelog

Added

  • feat: Cross App Access (ID-JAG), branding theme identifiers, Self-Service Enterprise Configuration third-party client access, session actor #877 (fern-api[bot])

6.0.0 (2026-07-15)

Full Changelog

⚠️ Breaking Changes

  • ConnectionAttributeIdentifier removed (no compatibility alias); split into three types. The identifier field on each attribute now points to its own type:
    • EmailAttribute.identifier: EmailAttributeIdentifier — {active?, default_method?: DefaultMethodEmailIdentifierEnum} (same shape as the old type; use this as the drop-in replacement).
    • PhoneAttribute.identifier: PhoneAttributeIdentifier — {active?, default_method?: DefaultMethodPhoneNumberIdentifierEnum}.
    • UsernameAttribute.identifier: UsernameAttributeIdentifier — {active?} (no default_method).
  • PhoneProviderProtectionBackoffStrategyEnum: Literal["exponential", "none"] → Literal["exponential", "default"]. Replace the value "none" with "default".
  • ListRolesOffsetPaginatedResponseContent.start / .limit / .total: Optional[float] = None → required float. Deserializing a role-list response missing any of these now raises pydantic.ValidationError.
  • Federated Connections Tokensets removed — the users.federated_connections_tokensets client and its list/delete methods are removed, along with the FederatedConnectionTokenSet and ConnectionFederatedConnectionsAccessTokens types.
  • federated_connections_access_tokens field removed — this optional field is no longer present on ConnectionOptionsAzureAd, ConnectionOptionsCommonOidc, ConnectionOptionsGoogleApps, ConnectionPropertiesOptions, and UpdateConnectionOptions.
  • OAuth scopes removed — read:federated_connections_tokens and delete:federated_connections_tokens are no longer valid values of OauthScope.
  • ClientSessionTransferDelegationDeviceBindingEnum narrowed — the "asn" value is removed; the enum now only accepts "ip".

New Endpoints

  • organizations.roles.members.list(id=..., role_id=...) (sync + async) → GET /api/v2/organizations/{id}/roles/{role_id}/members. New sub-clients organizations.roles and organizations.roles.members; response type ListOrganizationRoleMembersResponseContent, item type RoleMember.

Type Changes/Features

  • Organizations: third_party_client_access: Optional[OrganizationThirdPartyClientAccessEnum] (Literal["block", "allow"]) on create()/update() and all organization response types.
  • Organizations: new types ListOrganizationRoleMembersResponseContent and RoleMember (returned by the role-members endpoint above).
  • Grants: new UserGrant.organization_id: Optional[str] (read-only), via GET /grants.
  • Connections: discovery_url / oidc_metadata extended to samlp connections (previously OIDC-only), via new ConnectionsDiscoveryUrl / ConnectionsOidcMetadata on ConnectionPropertiesOptions and UpdateConnectionOptions.
  • Event Streams: new event-type values connection.created, connection.deleted, connection.updated on EventStreamEventTypeEnum, EventStreamDeliveryEventTypeEnum, EventStreamSubscribeEventsEventTypeEnum, EventStreamTestEventTypeEnum; new EventStreamCloudEventConnection{Created,Deleted,Updated}* payload types; new EventStreamSubscribeEventsResponseContent.
  • Token Vault: new grants: Optional[List[TokenVaultPrivilegedAccessGrant]] on the privileged-access credential/public-key types. TokenVaultPrivilegedAccessGrant: {connection: str, scopes: List[str]}.
  • New error body types: NotFoundErrorBody/NotFoundErrorBodyError, TooManyRequestsErrorBody/TooManyRequestsErrorBodyError.
  • CloudEvent specversion: str → EventStreamCloudEventSpecVersionEnum (Literal["1.0"] + Any fallback) across group/org/user CloudEvent types.
  • NetworkAclMatch — new optional auth0_managed: Optional[List[str]] field (serialized as auth0_managed), available on both the match and not_match rule blocks. This lets network ACL rules reference Auth0-managed lists when matching or excluding traffic.

5.8.0 (2026-06-29)

Full Changelog

⚠️ Breaking Changes

  • clients.update() social/FedCM request types changed — native_social_login and fedcm_login on clients.update() (PATCH /api/v2/clients/{id}) changed from NativeSocialLogin / FedCmLogin to NativeSocialLoginPatch / FedCmLoginPatch. clients.create() still uses the non-patch types, so create and update now require different types for the same logical field. Code passing the old types to update() must switch to the *Patch variants.
  • UserDateSchema removed — user date fields now datetime — the UserDateSchema type (Union[str, Dict[str, Any]]) is deleted and no longer exported from auth0.management.types. created_at, updated_at, last_login, last_password_reset, and multifactor_last_modified on GetUserResponseContent, CreateUserResponseContent, UpdateUserResponseContent, and UserResponseSchema are now Optional[datetime.datetime]. Code that read these as strings/dicts must update.

Type Changes

  • Clients — FedCM / Google One Tap — new fedcm_login (read: FedCmLogin/FedCmLoginGoogle; write: FedCmLoginPatch/FedCmLoginGooglePatch) on create/update/response, gating the Google One Tap prompt in New Universal Login via fedcm_login.google.is_enabled.
  • Clients — Native Social Login patch types — new NativeSocialLoginPatch wrapping apple/facebook/google patch variants (each enabled: Optional[bool]) for clients.update().
  • Clients — Token Vault Privileged Access — new token_vault_privileged_access field on create/update/response, typed ClientTokenVaultPrivilegedAccessWithPublicKey (create) and ClientTokenVaultPrivilegedAccessWithCredentialId (update), each with credentials + ip_allowlist.
  • Connections — Cross App Access — new cross_app_access_requesting_app field (CrossAppAccessRequestingApp{active: bool}) on connections.create()/update(), OIDC/Okta request types, and all connection response types.
  • Identity user_id widened to Union[str, int] — on UserIdentitySchema, UserIdentity, and DeleteUserIdentityResponseContentItem, fixing Pydantic errors on numeric (e.g. GitHub) identity IDs.
  • Email templates — new auth_email_by_code value in EmailTemplateNameEnum.
  • Attack Protection — Phone Provider Protection — new attack_protection.phone_provider_protection sub-client with get() / patch(type=...) (GET/PATCH /attack-protection/phone-provider-protection); new PhoneProviderProtectionBackoffStrategyEnum (exponential/none) and response types.

Bug Fixes

  • 404 handling added across multiple raw clients — keys.signing, organizations (connections, enabled connections, members, member roles), roles.permissions, self_service_profiles.sso_ticket, user_attribute_profiles, and users (connected accounts, organizations, permissions, roles) now raise a typed NotFoundError on 404 instead of an unhandled parse error.
  • add "CustomDomainHeader" to __all__.
  • change CustomDomainHeader return type annotation from Dict[str, Any] to RequestOptions.

5.7.0 (2026-06-10)

Full Changelog

⚠️ Breaking Changes

  • identifiers parameter removed from branding.update(); identifiers field removed from GetBrandingResponseContent and UpdateBrandingResponseContent. The following types are no longer exported from auth0.management.types: BrandingIdentifiers, UpdateBrandingIdentifiers, BrandingPhoneDisplay, UpdateBrandingPhoneDisplay, BrandingLoginDisplayEnum, BrandingPhoneFormattingEnum, BrandingPhoneMaskingEnum, UpdateBrandingLoginDisplayEnum, UpdateBrandingPhoneFormattingEnum, UpdateBrandingPhoneMaskingEnum. These settings now live exclusively on the theme resource (PATCH /api/v2/branding/themes/{id}) #860 (fern-api[bot])
  • id was a required str on PhoneTemplate, GetPhoneTemplateResponseContent, CreatePhoneTemplateResponseContent, UpdatePhoneTemplateResponseContent, and ResetPhoneTemplateResponseContent. It is now Optional[str]. Code that accesses .id without a None check will require updating #860 (fern-api[bot])

Added

  • feat: security_headers (TenantSettingsNullableSecurityHeaders, CSP + XSS protection config), country_codes (TenantSettingsCountryCodesResponse, phone identifier allow/deny list), and include_session_metadata_in_tenant_logs (bool) added to GetTenantSettingsResponseContent and UpdateTenantSettingsResponseContent #860 (fern-api[bot])
  • feat: id_token_session_expiry_supported (ConnectionIdTokenSessionExpirySupported) added to ConnectionOptionsCommonOidc and UpdateConnectionOptions #860 (fern-api[bot])
  • feat: new invitation_landing_client_id Optional field added to ClientMyOrganizationPostConfiguration, ClientMyOrganizationPatchConfiguration, and ClientMyOrganizationResponseConfiguration - available on POST /clients, PATCH /clients/{id}, GET /clients, and GET /clients/{id} #860 (fern-api[bot])

Fixed

  • fix: GET /client-grants/{id}/organizations — added 404 handling; raises NotFoundError when the grant does not exist (was previously an unhandled parse error) #860 (fern-api[bot])
  • fix: PATCH /token-exchange-profiles/{id} — added 409 handling; raises ConflictError when a profile with the same subject_token_type already exists (was previously an unhandled parse error) #860 (fern-api[bot])

5.6.0 (2026-05-28)

Full Changelog

Added

  • feat: rate_limit_policies client with full CRUD: list, create, get, update, delete #853 (fern-api[bot])
  • feat: Response Types: RateLimitPolicyConfigurationZero (allow), RateLimitPolicyConfigurationOne (block/log + limit), RateLimitPolicyConfigurationAction (redirect + limit + redirect_uri), RateLimitPolicy #853 (fern-api[bot])
  • feat: OAuth scopes: create:rate_limit_policies, read:rate_limit_policies, update:rate_limit_policies, delete:rate_limit_policies #853 (fern-api[bot])
  • feat: Support for groups.roles — list, create, delete #853 (fern-api[bot])
  • feat: Support for roles.groups — get, create, delete #853 (fern-api[bot])
  • feat: Support for users.effective_roles / users.effective_roles.sources.groups #853 (fern-api[bot])
  • feat: Support for users.effective_permissions / users.effective_permissions.sources.roles #853 (fern-api[bot])
  • feat: Support for organizations.groups — list #853 (fern-api[bot])
  • feat: Support for organizations.groups.roles — list, create, delete #853 (fern-api[bot])
  • feat: Support for organizations.members.effective_roles / organizations.members.effective_roles.sources.groups #853 (fern-api[bot])
  • feat: Types for SCIM Groups: effective role/permission response types, org-member effective role types, paginated list wrappers, source enum discriminators #853 (fern-api[bot])
  • feat: OAuth scopes: create/read/delete:group_roles, read:organization_groups, create/read/delete:organization_group_roles, read:organization_member_effective_roles, read:organization_member_role_source_groups, read:user_effective_roles, read:user_role_source_groups, read:user_effective_permissions, read:user_permission_source_roles #853 (fern-api[bot])

Changed

  • ConnectionPropertiesOptions — dpop_signing_alg field added (write path for POST /api/v2/connections) #853 (fern-api[bot])
  • UpdateConnectionOptions — dpop_signing_alg field added (write path for PATCH /api/v2/connections/{id}) #853 (fern-api[bot])

5.5.0 (2026-05-20)

Full Changelog

⚠️ Breaking: Python 3.9 support dropped

  • Python 3.9 reached end-of-life in October 2025. This release requires Python >=3.10. Users on Python 3.9 should remain on v5.4.0 until they upgrade their Python version. #843 (developerkunal)

Added

  • feat: configurable max_retries parameter to Auth0 and AsyncAuth0 clients (defaults to 2 with exponential backoff) #841 (fern-api[bot])
  • feat: New error types: BadRequestSchema, ForbiddenSchema, UnauthorizedSchema, TooManyRequestsSchema #841 (fern-api[bot])
  • feat: New types: FedCmLogin, FedCmLoginGoogle, CredentialDeviceTypeEnum #841 (fern-api[bot])
  • Extended user_authentication_method and resource_server response types with additional fields #841 (fern-api[bot])
  • Expanded clients, refresh_tokens, resource_servers, tickets, and users/authentication_methods endpoint parameters

Changed

5.4.0 (2026-05-04)

Full Changelog

Added

  • chore: Add events module, async token support, and connection retry resilience #835 (fern-api[bot])

Changed

Fixed

5.3.0 (2026-04-09)

Full Changelog

Added

  • feat: Add CIMD support, organization connections, group deletion, refresh token listing; remove AOL/Flickr/Yammer providers #816 (fern-api[bot])
  • feat:Add Auth0-Custom-Domain header support for Multiple Custom Domains (MCD) #799 (kishore7snehil)

5.2.0 (2026-03-30)

Full Changelog

⚠️ Breaking: Python 3.8 support dropped

  • Python 3.8 reached end-of-life in October 2024. This release requires Python >=3.9.2. Users on Python 3.8 should remain on v5.1.0 until they upgrade their Python version. #808 (kishore7snehil)

Added

  • feat: Add default domain endpoints, connection key provisioning, tenant SCIM listing; remove MiiCard/Renren providers #801 (fern-api[bot])
  • feat: Add client_info support for custom telemetry in Authentication and Management clients #802 (kishore7snehil)
  • feat: Add SDK logging infrastructure with configurable log levels and header redaction #785 (fern-api[bot])

Fixed

Changed

  • chore: Update ruff, aiohttp, cryptography, urllib3, codecov-action; replace Snyk with SCA scan #808 (kishore7snehil)

5.1.0 (2026-02-11)

Full Changelog

Fixed

  • fix: Remove placeholder defaults from optional parameters + additional updates #778 (fern-api[bot])

5.0.0 (2026-02-04)

Full Changelog

📢 This is the official v5.0.0 release with significant improvements and breaking changes.

Breaking Changes

  • Complete rewrite of Management API client - Generated from Auth0's OpenAPI specifications using Fern
  • Python 3.7 support dropped - Minimum required version is now Python 3.8
  • Management API client restructured - Methods organized into modular sub-clients for better discoverability
  • Method signatures changed - Consistent and predictable naming conventions across all endpoints
  • Response types changed - Strongly-typed Pydantic models replace generic dictionaries
  • Import paths changed - from auth0.management.core.api_error import ApiError instead of from auth0.exceptions import Auth0Error
  • Pagination defaults changed - include_totals=True is now the default for list operations
  • Client initialization simplified - ManagementClient takes domain instead of full base_url

Added

  • First-class async support with AsyncAuth0 and AsyncManagementClient
  • Automatic token management with client credentials in ManagementClient
  • Built-in pagination support with include_totals=True by default
  • Type-safe request/response objects using Pydantic models
  • Better IntelliSense and code completion support
  • Comprehensive API reference documentation
  • Migration guide for upgrading from v4.x

Changed

  • Management API client fully regenerated using Fern
  • Package structure reorganized with hierarchical sub-clients
  • Error handling updated to use ApiError base class
  • Documentation updated with v5 examples

Note

  • Authentication API remains fully backward compatible - no changes required
  • See v5_MIGRATION_GUIDE.md for detailed upgrade instructions

4.13.0 (2025-09-17)

Full Changelog

Added

  • fix(backchannel): expose headers on slow_down errors (HTTP 429s) #744 (pmalouin)

4.12.0 (2025-09-15)

Full Changelog

Added

4.11.0 (2025-09-11)

Full Changelog

Added

Fixed

4.10.0 (2025-06-05)

Full Changelog

Added

  • chore: merge community PRs – bugfixes, features, and dependency upgrades #696 (kishore7snehil)

Fixed

4.9.0 (2025-04-01)

Full Changelog

Added

4.8.1 (2025-02-24)

Full Changelog

Fixed

4.8.0 (2025-01-29)

Full Changelog

Added

Fixed

4.7.2 (2024-09-10)

Full Changelog

Security

4.7.1 (2024-02-26)

Full Changelog

Security

4.7.0 (2023-12-05)

Full Changelog

⚠️ BREAKING CHANGES

Added

  • [SDK-4138] Add support for Pushed Authorization Requests (PAR) #560 (adamjmcgrath)

4.6.1 (2023-11-29)

Full Changelog

Fixed

4.6.0 (2023-11-09)

Full Changelog

Added

  • [SDK-4544] Add orgs in client credentials support #549 (adamjmcgrath)
  • Authentication API, the Database classs, Add the organization param to the change_password method #539 (shchotse)
  • Retry all methods on 429 #518 (adamjmcgrath)

4.5.0 (2023-10-20)

Full Changelog

Added

4.4.2 (2023-08-31)

Full Changelog

Fixed

4.4.1 (2023-08-21)

Full Changelog

Fixed

4.4.0 (2023-07-25)

Full Changelog

Added

Fixed

  • Fix asyncify for users client where token is not required #506 (cgearing)

4.3.0 (2023-06-26)

Full Changelog

Added

Fixed

4.2.0 (2023-05-02)

Full Changelog

Added

  • Add cache_ttl param to AsymmetricSignatureVerifier #490 (matei-radu)

4.1.1 (2023-04-13)

Full Changelog

Fixed

4.1.0 (2023-03-14)

Full Changelog

Added

4.0.0 (2023-01-19)

Full Changelog

Added

Security

Changed

⚠️ BREAKING CHANGES

See the V4_MIGRATION_GUIDE for more info.

3.24.1 (2023-01-19)

Full Changelog

Fixed

  • Remove unnecessary type param from update_template_universal_login #463 (adamjmcgrath)

3.24.0 (2022-10-17)

Full Changelog

Added

Fixed

3.23.1 (2022-06-10)

Full Changelog

Fixed

3.23.0

Added

3.22.0

Added

  • [SDK-3174] Add DELETE method for /api/v2/users/{id}/authenticators endpoint #301 (akmjenkins)
  • [SDK-3175] Return token claims in TokenVerifier.verify() #273 (bisguzar)

Fixed

  • [SDK-3173] Default to 'None' for deployed on GET /api/v2/actions/actions endpoint #309 (evansims)

3.21.0

Added

3.20.0

Added

3.19.0

Added

Changed

  • Remove references to ID token in generic token classes #295 (lbalmaceda)

Fixed

  • Use assertNotEqual instead of assertNotEquals for Python 3.11 compatibility. #294 (tirkarthi)

3.18.0

Added

3.17.0

Added

  • Make the CI fail when the docs syntax is invalid #287 (lbalmaceda)
  • [SDK-2687] Implement automatic rate-limit handling #285 (evansims)
  • Use Sphinx to generate API docs #281 (lbalmaceda)
  • Add Passwordless Login function #279 (lbalmaceda)
  • [SDK 2665] Update endpoint methods to support 'from' and 'take' checkpoint pagination parameters, where appropriate #278 (evansims)

Deprecated

3.16.2

Fixed

3.16.1

Fixed

3.16.0

Added

3.15.0

Added

3.14.0

Added

  • Adds a new user method invalidate_remembered_browsers #248 (kpurdon)

3.13.0

Added

Fixed

3.12.0

Added

  • Add missing user profile properties to the signup endpoint #231 (lbalmaceda)
  • Add Hooks management API #227 (guillp)
  • Add missing external_id property to the import users job #222 (lbalmaceda)

Changed

Fixed

  • Skip sending optional parameters on POST request when unspecified #230 (lbalmaceda)

3.11.0

Added

Removed

  • Add deprecation note for DELETE /users (all users) #217 (lbalmaceda)

3.10.0

Security

Added

3.9.2

Fixed

3.9.1

Changed

3.9.0

Added

3.8.1

July 18, 2019: This release included an unintentionally breaking change affecting those users that were manually parsing the response from GET requests. e.g. /userinfo or /authorize. The AuthenticationBase#get method was incorrectly parsing the request result into a String.

From this release on, making a GET request returns a Dictionary instead.

Breaking Change

  • Fix request creation when headers are the default #198 (lbalmaceda).

3.8.0

Fixed

Security

3.7.2

Fixed

3.7.1

Fixed

3.7.0

Changed

3.6.1

Fixed

  • Fixed Management API Grants class instantiation #179 (beck3905)

3.6.0

Added

  • Add grants, custom domains, rules_configs to API #177 (sagnew-dg)

3.5.0

Added

3.4.0

Added

  • Add client_id param to ClientGrants.all #159 (danishprakash)
  • Add telemetry headers to AuthenticationBase #152 (crgk)
  • Add pre-commit pypgrade hook and update supported versions #124 (hugovk)
  • Implemented delete_user_by_email and test for connections #122 (runz0rd)
  • Adds user export job creation. #112 (dmark)

Changed

  • String Formatting Updated #141 (vkmrishad)
  • Uses Python built-in modules to retrieve Python and auth0-python version number #125 (edawine)

Fixed

  • Stop lower-casing email on user search #167 (helmus)
  • Always include Content-Type header in management requests #158 (crgk)

3.3.0

Added

  • Add pagination to Clients and Connections
  • Add pagination to Client Grants, Resource Servers and Rules
  • Add Email-Templates Management API endpoints

Fixed

  • Replace default mutable arguments with None
  • Fix JSON error message handling for Management API

3.2.2

Fixed

  • Upload the correct package contents to Pypi.

3.2.0

Added

Fixed

  • Correctly throw an exception when handing a text response #92 (benbc)
  • Instantiate UserBlocks for consistency #90 (mattdodge)

3.1.4

Authentication API

  • Improve handling of inconsistent API error responses.

3.1.3

Management API

  • Added upsert parameter to import_users job.

3.1.2

Authentication API

  • Added refresh_token method to get_token

3.1.0

Authentication API

  • Added Logout Functionality

3.0.0

Authentication API

  • Added Support for API Authorization. oauth/token endpoint
    • Client Credentials Grant
    • Authorization Code Grant
    • Authorization Code PKCE Grant
    • Resource Owner Password Realm Grant
  • Added Support for API Authorization. authorize endpoint
    • Authorization Code Grant

Management API v2

  • Added Support for Guardian
  • Added Support to retrieve Logs
  • Added Support to manage Resource Servers
  • Added Support to manage Client Grants
  • Added Support to manage User blocks