feat: Agents client, Organization Clients & Role Groups, Directory Provisioning sync groups, Guardian factor settings & paginated Event Stream Deliveries

[fern-api]

Summary

It adds support for the following initiatives:

• Organization-to-Application Entitlement
• Google Workspace Inbound Groups Directory Provisioning
• Organization-Level Roles
• New Agents client
• Guardian factor settings
• Checkpoint pagination support for Event Stream Deliveries
• Behavioral change to the default include_totals value on list endpoints

---

Agents (New)

Introduces a new top-level agents() client (sync, async, and raw-response variants) with full CRUD support.

Operation	Method
List agents (paged)	agents().list(...)
Create an agent	agents().create(CreateAgentRequestContent)
Retrieve an agent	agents().read(id)
Update an agent	agents().update(id, PatchAgentRequestParameters)
Delete an agent	agents().delete(id)

New scopes

• create:agents
• read:agents
• update:agents
• delete:agents

New models

• AgentResponseContent
• CreateAgentRequestContent
• PatchAgentRequestParameters
• ListAgentsRequestParameters
• ListAgentsResponseContent

---

Organization-to-Application Entitlement

New organizations().clients() sub-client

Supports organization-to-application associations

Operation	Method
List clients for an organization (checkpoint pagination)	list(orgId, ...)
Associate multiple clients	create(orgId, CreateOrganizationClientsRequestContent)
Retrieve an association	get(orgId, clientId)
Update an association	update(orgId, clientId, UpdateOrganizationClientRequestContent)
Remove multiple clients	delete(orgId, DeleteOrganizationClientsRequestContent)

New scopes

• create:organization_clients
• read:organization_clients
• update:organization_clients
• delete:organization_clients

New models

• OrganizationClient
• OrganizationClientAssociation
• OrganizationClientMetadata
• OrganizationClientMetadataOrganizationUsageEnum
• CreateOrganizationClientRequestItem
• CreateOrganizationClientsRequestContent
• DeleteOrganizationClientsRequestContent
• UpdateOrganizationClientRequestContent
• GetOrganizationClientResponseContent
• UpdateOrganizationClientResponseContent
• ListOrganizationClientsRequestParameters
• ListOrganizationClientsResponseContent

Organization entitlement fields

Added is_app_entitlement_active (Boolean) to:

• Organization
• CreateOrganizationRequestContent
• UpdateOrganizationRequestContent
• Organization read responses

ListOrganizationsRequestParameters now supports:

• include_client_association_for

---

Google Workspace Inbound Groups Directory Provisioning

Synchronized group selection management

Added new operations to connections().directoryProvisioning():

• addSynchronizedGroupSelections(id, AddSynchronizedGroupsRequestContent)
• deleteSynchronizedGroupSelections(id, DeleteSynchronizedGroupsRequestContent)

New models

• AddSynchronizedGroupsRequestContent
• DeleteSynchronizedGroupsRequestContent
• SynchronizedGroupSelectionId

Updated:

• SynchronizedGroupPayload
• ListSynchronizedGroupsRequestParameters

Self-Service Profiles

SelfServiceProfileSsoTicketGoogleWorkspaceConfig now exposes an optional sync_groups (Boolean) property alongside sync_users, enabling delegated Google directory group provisioning during self-service flows.

---

Organization-Level Roles

Role type & ownership

Added the following fields to:

• Role
• CreateRoleRequestContent
• Role response models

New fields:

• type (RoleTypeEnum) — tenant or organization (defaults to tenant)
• owner_id (String) — Organization ID for organization-level roles

ListRolesRequestParameters now supports:

• type
• ownerId
• Checkpoint pagination

Organization Role Groups

Added a new organizations().roles().groups() sub-client.

New operation

• list(organizationId, roleId, ...) — Retrieve all groups assigned to a role in the context of an organization.

Organization Role Members

Added a new organizations().roles(). members() sub-client.

New operation

• list(organizationId, roleId, ...) — Retrieve all organization members that are assigned to a role in the context of an organization.

New models

• RoleGroup
• ListOrganizationRoleGroupsRequestParameters
• ListOrganizationRoleGroupsResponseContent

---

Guardian

GuardianFactor now exposes an optional settings object (GuardianFactorSettings) containing:

• otp_length
• otp_expiration_time

---

API Fixes / Behavioral Changes

include_totals now defaults to true ⚠️

Numerous list endpoints that previously omitted include_totals now send include_totals=true by default, including:

• Connections
• Groups
• Organizations
• Client Grants
• Organization Members
• Role Users
• Flow Executions
• User Groups
• User Refresh Tokens
• User Sessions
• Other generated list endpoints

Additionally, the parameter type changed from:

• Optional<Boolean> → OptionalNullable<Boolean>

⚠️ Behavioral change

Affected list(...) calls now return the totals-wrapped response object by default instead of a bare array.

Existing callers that relied on the array response should explicitly pass:

includeTotals(false)

Note

Generated parameter documentation currently states "(false, default)", while the serialized default is true. This appears to be a specification/generator discrepancy.

Event Stream Deliveries - Checkpoint Pagination (Breaking)

deliveries().list(...) now returns:

SyncPagingIterable<EventStreamDelivery>

instead of:

List<EventStreamDelivery>

This aligns the SDK with the checkpoint-paginated API response containing a next cursor

⚠️ Breaking change

Callers assigning results to List<EventStreamDelivery> or using .size(), .get(), or .stream() must migrate to SyncPagingIterable<EventStreamDelivery>.

Enhanced for loops continue to work unchanged.

---

Miscellaneous

• Added country_codes to AculContextEnum.
• Added shared error schemas:
  • NotFoundSchema / NotFoundSchemaError
  • ConflictSchema / ConflictSchemaError

---

Testing

Automated

• Existing generated wire tests pass.
• Added/updated:
  • AgentsWireTest
  • OrganizationsClientsWireTest
  • OrganizationsRolesGroupsWireTest
  • ConnectionsDirectoryProvisioningWireTest
  • GuardianFactorsWireTest
  • EventStreamsDeliveriesWireTest
  • RolesWireTest
  • OrganizationsWireTest

Manual

Validated:

• Creating and listing Agents
• Managing Organization Client associations
• Listing Organization Role Groups
• Managing Directory Provisioning synchronized group selections
• Verifying Guardian factor settings
• Exercising Event Stream Delivery checkpoint pagination
• Validating role filtering using type and owner_id

---