feat: Add user API key methods

[ethinallen]

Add userManagement.listUserApiKeys() and userManagement.createUserApiKey() for the user-scoped API key endpoints. The new types and serializers cover pagination, organization filtering, optional permissions and expiration, idempotency keys, and camel-cased user ownership metadata.

This complements #1650, which already added dual-owner ApiKey.owner types and camelized owner.organizationId during validation deserialization.

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

If yes, link a related docs PR and add a docs maintainer as a reviewer. Their approval is required.

Link to Devin session: https://app.devin.ai/sessions/d37c887495594308a34bd8db9556dee9
Requested by: @ethinallen

[devin-ai-integration]

Original prompt from drew.emery

SYSTEM:
=== BEGIN THREAD HISTORY (in #docs-and-sdks) ===
<most_recent_message>
Drew Emery (U07PHF0U4P4): @Devin can you create a fix for the Node SDK that addresses:
• TypeScript types for ApiKey.owner only model organization-owned keys, not user-owned keys (owner.type is locked to 'organization', missing 'user' variant and organization_id field)
• deserializeApiKey doesn't camelize owner.organization_id to organizationId like other fields
• no SDK methods for user API key CRUD (POST/GET /user_management/users/{userId}/api_keys). Other SDKs (Python v7.0.0, .NET v4.0.0, PHP v6.0.0) have already shipped breaking changes for dual ownership model restructuring

[Slack unfurl — this is an automatic link preview, not a user message]
Quote of conversation (https://work-os.slack.com/archives/C0A4US8LCF9/p1783640070645839):
> From Bilal Shaikh
> Hey team! We're adopting the new user-scoped API keys (great addition!) and hit a gap in ``@workos-inc/node that we've confirmed on the latest release (10.7.0):

> 1. ApiKey.owner typings don't model user-owned keys. apiKeys.createValidation() returns owner: { type: "user", id: "user_…", organization_id: "org_…" } at runtime for user-scoped keys (verified against the live API), but the type is declared as { type: 'organization'; id: string }. TypeScript consumers can't branch on owner.type === "user" or read owner.organization_id without bypassing the type system.

> 2. owner.organization_id isn't camelized. deserializeApiKey camelizes every other field but passes owner through raw, so it's the lone snake_case field on the object. We've coded against the runtime shape for now — if the fix camelizes it to organizationId, that'll be a silent runtime break for anyone doing the same, so a heads-up in the release notes would be appreciated.

> 3. No SDK methods for user API key CRUD (POST/GET /user_management/users/{userId}/api_keys) — only the organization variants exist. We're calling the REST endpoin... (793 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[greptile-apps]

Greptile Summary

This PR adds user-scoped API key methods to User Management. The main changes are:

• Adds listUserApiKeys() and createUserApiKey() SDK methods.
• Adds request and response types for user-owned API keys.
• Adds serializers for pagination, organization filtering, expiration dates, and returned key values.
• Adds fixtures and tests for list, create, response mapping, query serialization, and idempotency keys.

Confidence Score: 5/5

This PR is safe to merge with minimal risk.

The changes follow existing SDK patterns for pagination, serialization, idempotency request options, and response deserialization. Tests cover the key request and response paths. No new correctness or security issues were identified beyond the previously discussed fixture concern, which is not repeated.

No files require special attention.

T-Rex Logs

What T-Rex did

• T-Rex ran the pre-change Jest test against the before-state and confirmed the command completed with exit code 0.
• T-Rex ran the post-change Jest test against the current repository and confirmed the command completed with exit code 0.
• T-Rex ran TypeScript type checking for the user_api_keys module and confirmed tsc --noEmit completed with exit code 0.
• T-Rex inspected the change-context artifact to verify the compared commits and the user-management diff stat.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
src/user-management/user-management.ts	Adds user-scoped API key list and create methods using existing pagination, request, and serializer helpers.
src/user-management/user-management.spec.ts	Adds coverage for listing, query serialization, creation payloads, response mapping, and idempotency headers.
src/user-management/serializers/user-api-key.serializer.ts	Maps serialized user API key responses into SDK camelCase properties.
src/user-management/serializers/create-user-api-key-options.serializer.ts	Serializes create-user API key options to API snake_case fields, including ISO expiration dates.
src/user-management/interfaces/user-api-key.interface.ts	Defines serialized and deserialized user-owned API key shapes with camelized owner organization metadata.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant SDK as WorkOS SDK userManagement
participant Serializer as User API key serializers
participant API as WorkOS API

SDK->>Serializer: serialize list/create options
alt listUserApiKeys
    SDK->>API: "GET /user_management/users/{userId}/api_keys"
    API-->>SDK: serialized list of api_key objects
    SDK->>Serializer: deserializeUserApiKey for each item
    SDK-->>SDK: "return AutoPaginatable<UserApiKey>"
else createUserApiKey
    SDK->>API: "POST /user_management/users/{userId}/api_keys"
    API-->>SDK: serialized api_key plus value
    SDK->>Serializer: deserializeUserApiKeyWithValue
    SDK-->>SDK: return UserApiKeyWithValue
end

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant SDK as WorkOS SDK userManagement
participant Serializer as User API key serializers
participant API as WorkOS API

SDK->>Serializer: serialize list/create options
alt listUserApiKeys
    SDK->>API: "GET /user_management/users/{userId}/api_keys"
    API-->>SDK: serialized list of api_key objects
    SDK->>Serializer: deserializeUserApiKey for each item
    SDK-->>SDK: "return AutoPaginatable<UserApiKey>"
else createUserApiKey
    SDK->>API: "POST /user_management/users/{userId}/api_keys"
    API-->>SDK: serialized api_key plus value
    SDK->>Serializer: deserializeUserApiKeyWithValue
    SDK-->>SDK: return UserApiKeyWithValue
end

Loading

_{Reviews (2): Last reviewed commit: "Use placeholder API key fixture" | Re-trigger Greptile}