From b1e3a67b939b2f320686e1b599424b4748ad13dc Mon Sep 17 00:00:00 2001
From: "workos-sdk-automation[bot]"
 <255426317+workos-sdk-automation[bot]@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:12:44 +0000
Subject: [PATCH] Update OpenAPI spec from
 workos/workos@e5e97a3445a46e45204c36dff0f42eaf210a6c16

---
 .last-synced-sha        |  2 +-
 spec/open-api-spec.yaml | 80 +++++++++++++++++++++++++----------------
 2 files changed, 51 insertions(+), 31 deletions(-)

diff --git a/.last-synced-sha b/.last-synced-sha
index 9637f93..fe83518 100644
--- a/.last-synced-sha
+++ b/.last-synced-sha
@@ -1 +1 @@
-53bd1a3d0316e90cc64eb9ce339bcd04b55077df
+e5e97a3445a46e45204c36dff0f42eaf210a6c16
diff --git a/spec/open-api-spec.yaml b/spec/open-api-spec.yaml
index 8fba8b1..f74ac55 100644
--- a/spec/open-api-spec.yaml
+++ b/spec/open-api-spec.yaml
@@ -13,36 +13,56 @@ paths:
         content:
           application/json:
             schema:
-              type: object
-              properties:
-                type:
-                  type: string
-                  enum:
-                    - api_key
-                    - access_token
-                  description: >-
-                    The kind of credential being validated — an agent API key or
-                    an agent access token.
-                  example: access_token
-                credential:
-                  type: string
-                  minLength: 1
-                  description: >-
-                    The credential value to validate: the API key value for
-                    `api_key`, or the access token (JWT) for `access_token`.
-                  example: sk_agent_example_1234567890
-                audience:
-                  type: string
-                  minLength: 1
-                  description: >-
-                    Only applies to `access_token` credentials. When provided,
-                    the access token's `aud` claim is verified against this
-                    value — tokens issued for a different resource are rejected.
-                    Not permitted for `api_key` credentials.
-                  example: https://api.example.com
-              required:
-                - type
-                - credential
+              discriminator:
+                propertyName: type
+              oneOf:
+                - type: object
+                  properties:
+                    type:
+                      type: string
+                      description: >-
+                        The kind of credential being validated — an agent API
+                        key or an agent access token.
+                      const: api_key
+                    credential:
+                      type: string
+                      minLength: 1
+                      description: >-
+                        The credential value to validate: the API key value for
+                        `api_key`, or the access token (JWT) for `access_token`.
+                      example: sk_agent_example_1234567890
+                  required:
+                    - type
+                    - credential
+                - type: object
+                  properties:
+                    type:
+                      type: string
+                      description: >-
+                        The kind of credential being validated — an agent API
+                        key or an agent access token.
+                      const: access_token
+                    credential:
+                      type: string
+                      minLength: 1
+                      description: >-
+                        The credential value to validate: the API key value for
+                        `api_key`, or the access token (JWT) for `access_token`.
+                      example: eyJhbGciOiJSUzI1NiIsImtpZCI6...
+                    audience:
+                      type: string
+                      minLength: 1
+                      description: >-
+                        When provided, the access token's `aud` claim is
+                        verified against this value. Tokens issued for a
+                        different resource are rejected.
+                      example: https://api.example.com
+                  required:
+                    - type
+                    - credential
+              description: >-
+                The agent credential to validate. Either an `api_key` or an
+                `access_token`, discriminated by `type`.
       responses:
         '200':
           description: OK