Skip to content

Latest commit

 

History

History
904 lines (562 loc) · 51.9 KB

CHANGELOG.md

File metadata and controls

904 lines (562 loc) · 51.9 KB

Change Log

v6.5.0 (2026-10-14)

Full Changelog

Added

  • feat: add Client Profiles, Captcha Policies, and client and client grant search, and remove update_status from experiments and feature flags #812 (fern-api[bot])

Fixed

v6.4.0 (2026-09-30)

Full Changelog

Added

  • feat: adds Experiment Center APIs (EA), client OIDC support, and consent non-repudiation; removes organization template sub-client #808 (fern-api[bot])

v6.3.0 (2026-09-16)

Full Changelog

Added

  • feat: add Experiment Center advance-ramp, Guardian AFC factor settings, and Anonymous Sessions fields; remove top-level OrganizationTemplates client #803 (fern-api[bot])
  • feat: add Device Authorization Flow to the Authentication API #794 (gagalago)

v6.2.0 (2026-09-02)

Full Changelog

Added

  • feat: add Organization Templates, Connection Profile SCIM provisioning, and Network ACL HTTP message signatures #797 (fern-api[bot])
  • feat: support PKCE code_verifier in exchange_auth_code_for_tokens #791 (gagalago)

Fixed

  • fix: replace CGI.parse, removed in Ruby 4.0, with URI.decode_www_form #793 (gagalago)
  • fix: require auth0/version so client construction works and correct rest-client changelog note #790 (kishore7snehil)

v6.1.0 (2026-08-19)

Full Changelog

Added

  • feat: add Network ACL Key read/delete, Cross App Access resource app, third-party client access, and useOauthSpecScope #788 (fern-api[bot])

v6.0.0 (2026-08-13)

Full Changelog

Note: As this is a major release it is recommended to understand the Breaking Changes section before upgrading. The v6 Migration Guide contains detailed upgrade instructions.

v6.0.0 is the first stable release of the v6 line. The Management API client is now generated from Auth0's OpenAPI specification via Fern, with strongly-typed requests and responses, built-in pagination, and automatic token management through the unified Auth0::Client. The Authentication API is ported from v5 and maintains full feature parity.

Breaking Changes

  • Management API client rewritten using Fern code generation
  • Auth0Client replaced by Auth0::Client (unified client for Authentication + Management APIs; Auth0Client remains as a backward-compatible alias)
  • Management API methods accessed via namespaced sub-clients (client.users.list instead of client.users)
  • Method names follow a consistent pattern (list, create, get, update, delete), and sub-resource operations moved to dedicated sub-clients
  • All Management API methods use keyword arguments instead of positional parameters
  • API methods return strongly-typed response objects instead of raw hashes
  • List methods return paginated iterators instead of arrays
  • Non-2xx responses raise typed exceptions (Auth0::Errors::NotFoundError, etc.) instead of returning error hashes
  • The api_version parameter has been removed (v6 supports Management API v2 only)
  • Management API client uses net/http internally. The Authentication API still uses rest-client
  • Minimum Ruby version raised to 3.3

Added

  • Auto-generated Management API with complete endpoint coverage from Auth0's OpenAPI spec
  • Automatic OAuth 2.0 client credentials token management, with a new token_provider option for supplying tokens from an external source
  • Built-in retry with exponential backoff for transient failures (408, 429, 5xx)
  • Automatic pagination through iterator objects for all list endpoints
  • v6_MIGRATION_GUIDE.md for upgrading from v5

Unchanged

  • Authentication API (login, signup, token exchange, passwordless, MFA)

v6.0.0.beta.5 (2026-08-05)

Full Changelog

Added

  • feat: add Agents and Organization Clients clients, Organization Level Roles, and Org-to-App Entitlement #777 (fern-api[bot])

v6.0.0.beta.4 (2026-07-22)

Full Changelog

Added

  • feat: add Organization Role Members, Connection event streams, and Token Vault access grants #762 (fern-api[bot])
  • feat: add Events and Rate Limit Policies clients, remove Federated Connections Tokensets #767 (fern-api[bot])
  • feat: add Cross App Access and Identity Assertion grants, Branding Theme Identifiers, and Session actor #771 (fern-api[bot])

Breaking Changes

  • Rename ConnectionAttributeIdentifier to EmailAttributeIdentifier; the identifier field on email, phone, and username attributes is now EmailAttributeIdentifier, PhoneAttributeIdentifier, and UsernameAttributeIdentifier respectively #762
  • Replace the none member on PhoneProviderProtectionBackoffStrategyEnum with default #762
  • start, limit, and total on ListRolesOffsetPaginatedResponseContent are now required #762
  • Remove the Federated Connections Tokensets client (users.federated_connections_tokensets) and the FederatedConnectionTokenSet type #767

v6.0.0.beta.3 (2026-06-29)

Full Changelog

Added

  • feat: add Phone Provider Protection, Token Vault IP allowlist, and Cross App Access requesting app #758 (fern-api[bot])

v6.0.0.beta.2 (2026-06-12)

Full Changelog

Added

  • feat: add Tenant Security Headers and Connection Session Expiry; remove Branding Phone Display #751 (fern-api[bot])

v5.20.0 (2026-05-29)

Full Changelog

Changed

Fixed

  • Fix YARD comment with extra space #637 (qtro)

Security

v6.0.0.beta.1 (2026-05-28)

Full Changelog

Added

  • feat: Events API, Rate Limit Policies, refresh token revocation, FedCM, DPoP GA #732 (fern-api[bot])
  • feat: add SCIM Groups RBAC, User Effective Permissions/Roles, and Tenant Country Codes #742 (fern-api[bot])

v5.19.0 (2026-05-08)

Full Changelog

Added

Fixed

  • Ship only runtime files in packaged gem to eliminate scanner false positives #721 (tmertens)

6.0.0-beta.0 (2026-04-30)

Full Changelog

This beta release completely rewrites the Management API client using Fern code generation from the Auth0 OpenAPI specification. The Authentication API is ported from v5 and maintains full feature parity.

Breaking Changes

  • Management API client rewritten using Fern code generation
  • Auth0Client replaced by Auth0::Client (unified client for Auth + Management APIs)
  • Management API methods accessed via namespaced sub-clients (client.users.list instead of client.users)
  • API methods return strongly-typed response objects instead of raw hashes
  • List methods return paginated iterators instead of arrays
  • Non-2xx responses raise typed exceptions (Auth0::Errors::NotFoundError, etc.) instead of returning error hashes
  • Management API client uses net/http internally. The Authentication API still uses rest-client
  • Minimum Ruby version raised to 3.3

Added

  • Auto-generated Management API with complete endpoint coverage from Auth0 OpenAPI spec
  • Automatic OAuth 2.0 client credentials token management
  • Built-in retry with exponential backoff for rate-limited (429) responses
  • Configurable timeouts per request via request_options
  • Offset-based pagination with each iterators for all list endpoints
  • Telemetry headers on Management API requests
  • Wire tests (WireMock-based) for all Management API endpoints
  • New examples (Sinatra API and Rails 7 API)
  • v6_MIGRATION_GUIDE.md for upgrading from v5

Unchanged

  • Authentication API (login, signup, token exchange, passwordless, MFA) — ported from v5 with identical interface

v5.18.1 (2026-03-13)

Full Changelog

Changed

Fixed

  • fix deleting array content when passing an array as payload #697 (carlastabile)

Security

  • fix(deps): upgrade dev dependencies to resolve Snyk security vulnerab… #704 (arpit-jn)

v5.18.0 (2024-11-25)

Full Changelog

Added

  • Add Refresh Token endpoints for the Auth0 Management API #614 #623 (arpit-jn)
  • Add Management API calls for session API endpoints #613 #616 (arpit-jn)

v5.17.0 (2024-05-24)

Full Changelog

Added

v5.16.0 (2023-11-13)

Full Changelog

Added

v5.15.0 (2023-10-30)

Full Changelog

Added

v5.14.2 (2023-10-03)

Full Changelog

Fixed

  • [API] trigger_id and action_name parameters for create_action endpoint are now optional #478 rapito

v5.14.1 (2023-07-19)

Full Changelog

Fixed

v5.14.0 (2023-07-13)

Full Changelog

Added

v5.13.0 (2023-04-24)

Full Changelog

Added

Deprecated

v5.12.0 (2023-03-13)

Full Changelog

Added

Fixed

v5.11.0 (2023-01-27)

Full Changelog

Added

Changed

v5.10.0 (2022-10-10)

Full Changelog

Changed

Fixed

v5.9.0 (2022-08-24)

Full Changelog

Added

  • Add Delete All Authenticators API for Users #375 (phongnh)

Changed

Fixed

v5.8.1 (2022-06-30)

Full Changelog

Fixed

  • FIX: delete_organizations_members does not send members in body #345 (T-800)

Security

v5.8.0 (2022-03-25)

Full Changelog

Added

  • Add parameters for pager to device_credentials method #318 (shibayu36)

Fixed

  • Cache RS256 JWKS by url to allow for multiple Auth0 tenants per runtime #325 (rmm5t)
  • Allow to pass nil to client_id arg of device_credentials #321 (shibayu36)

Security

v5.7.0 (2022-02-17)

Full Changelog

Added

Fixed

  • [SDK-3106] Fix up tests for Ruby 3 and rspec-mocks update #313 (stevehobbsdev)
  • Fix #310: delete_organizations_member_roles should use delete_with_body instead of delete #311 (SanterreJo)

v5.6.1 (2021-09-14)

Full Changelog

Fixed

v5.6.0 (2021-09-14)

Full Changelog

Added

Deprecated

v5.5.0 (2021-08-06)

Full Changelog

Added

  • Automatically retry requests when API returns a 429 rate-limit status header. #290 (davidpatrick)

v5.4.0 (2021-07-23)

Full Changelog

Fixed

Changed

v5.3.0 (2021-07-23)

Full Changelog

Added

v5.2.0 (2021-07-20)

Full Changelog

Fixed

  • Ensure email param is properly encoded in delete_connection_user #280 (widcket)

Added

  • Adds Rotating Refresh Token type to Device Credentials #275 (epintos)

Changed

  • Do not lock dependencies to minor version #279 (athix)

v5.1.2 (2021-07-15)

Full Changelog

Security

v5.1.1 (2021-04-14)

Full Changelog

Fixed

v5.1.0 (2021-04-09)

Full Changelog

Added

v5.0.1 (2021-02-02)

Full Changelog

Added

  • Add test support for Ruby 2.6 and 2.7 and 3.0 #256 (fursich)

Fixed

Security

v5.0.0 (2020-10-22)

This release addresses some long standing issues with the library that could only be addressed in a major. We have also removed Api/v1 endpoints and other deprecated methods.

Migration from v4 to v5

Top Level Structs

The following top level structs were colliding with other libraries, this was addressed in #183 and have been namespaced with ::Auth0::

  • ApiToken changed to ::Auth0::ApiToken
  • Permission changed to ::Auth0::Permission
  • AccessToken changed to ::AccessToken::AccessToken

Api2 Users create_user method

This method was requiring you send in a name, which was optional, but didn't require connection_name which isn't optional. This was fixed in #244.

Auth0::Api::V2::Users.create_user(name, options = {}) has changed to Auth0::Api::V2::Users.create_user(connection_name, options = {})

APIv1 End of Life

APIv1 endpoints were deprecated in 4.x and now have been removed in v5. They reached end-of-life in the Public Cloud on 13 July 2020. Migration from v1 to v2 has been documented here https://auth0.com/docs/product-lifecycle/deprecations-and-migrations/migrate-to-management-api-v2

Catching 429 Errors

In 4.x RateLimitEncountered was inheriting from Auth0::Unsupported in order for backwards compatibility. This class is now inheriting Auth0::HTTPError. If you are catching 429 errors with Auth0::Unsupported then you will need to migrate to catching with Auth0::HTTPError.

Changes

Full Changelog

Fixed

  • Don't define structs as top-level constants (breaking changes) #183 (makimoto)
  • Fix create_user implementation (breaking changes) #244 (davidpatrick)

Removed

v4.17.1 (2020-10-21)

Full Changelog

Fixed

v4.17.0 (2020-10-19)

Full Changelog

Added

Deprecated

v4.16.0 (2020-10-02)

Full Changelog

Added

Security

v4.15.0 (2020-09-04)

Added

v4.14.0 (2020-07-20)

Full Changelog

Deprecated

Removed

Fixed

v4.13.0 (2020-06-18)

Full Changelog

Added

Fixed

v4.12.0 (2020-06-10)

Full Changelog

Added

Security

v4.11.0 (2020-05-06)

Full Changelog

Added

  • [SDK-1542] Add client secret to Passwordless flow since it is now required #217 (stevehobbsdev)

v4.10.0 (2020-04-23)

Full Changelog

Added

  • Added support for name_filter parameter [SDK-1607] #214 (Widcket)
  • Pass client_id, audience at Auth0::Api::V2::ClientGrants#client_grants #209 (hkdnet)
  • Add rubocop-rails #200 (tknzk)

Security

v4.9.0 (2019-09-25)

Full Changelog

Closed issues:

  • Dot in role name makes description disappear #194
  • Missing require Permission #192
  • Token required even when not necessary #190

Fixed:

Added:

  • Add Management API Guardian enrollments endpoint #182 (tomgi)

v4.8.0 (2019-08-01)

Full Changelog

Closed issues

  • Not enough information in exception when Rate Limiting is encountered #158

Added

Changed

Deprecated

Removed

Security

v4.7.0 (2019-03-19)

Full Changelog

Closed issues

  • No method to update/patch resource servers #156
  • No method to get all resource servers #154

Added

v4.6.0 (2018-12-17)

Full Changelog

Closed issues

  • New Release with Client Token work #148
  • Unable to initialize Auth0Api #147
  • Issues building the documentation #135
  • signin with referral token #127
  • Some challenges when upgrading to Ruby 2.5.1 #122
  • Cannot refresh access token with refresh token. #111
  • Incorrect request_params for username-password login #109
  • Obtain APIv2 Token #86

Added

Changed

Deprecated

  • Formal deprecation of 4 auth endpoint methods; rubocop #151 (joshcanhelp)

Fixed

v4.5.0 (2018-07-27)

Full Changelog

Closed issues:

  • New version with updated rest-client dependency #93
  • Bug?: result from auth0/mixins/httpproxy.rb returns 'nil' #88
  • import_users fails with EOFError #56
  • Using inside of a Rails API #55
  • Add documentation? #102
  • logout_url does not include client_id parameter #81

Merged pull requests:

v4.4.0 (2018-02-19)

Full Changelog

Closed issues:

  • Authentication Login is using /oauth/ro. #89

v4.3.0 (2018-02-19)

Full Changelog

Merged pull requests:

v4.2.0 (2018-02-15)

Full Changelog

Closed issues:

  • Vulnerable dependency: yard #99
  • post_password_change results in payload validation error #84
  • Unsupported on latest ruby version (2.4.0) #83
  • Adding a resource server breaks authentication. #76
  • outdated dependencies in ror-api example #75

Merged pull requests:

v4.1.0 (2016-07-25)

Full Changelog

Closed issues:

  • #post_password_change requires a password for ticket. #69
  • Exception messages are ruby hash string literals #63
  • Ruby on Rails API issue #61
  • Not possible to have V1 and V2 clients at the same time #60
  • Be able to control timeout #57
  • Version 4 changes #54
  • Implement API v2 #38

Merged pull requests:

  • Release 4.1.0 #71 (ignaciojonas)
  • Use JSON (result.body) for exception messages in requests #67 (ianks)
  • fixed rails api doesn't start, now impersionated links works with v2 #62 (Amialc)
  • Add api v2 log endpoints to the gem #59 (LindseyB)

v4.0.0 (2016-02-12)

Full Changelog

Closed issues:

  • Update LICENSE #47
  • Integration tests #15

Merged pull requests:

v3.6.1 (2015-07-09)

Full Changelog

Merged pull requests:

v3.6.0 (2015-06-01)

Full Changelog

Merged pull requests:

v3.5.0 (2015-05-21)

Full Changelog

Merged pull requests:

v3.4.0 (2015-05-07)

Full Changelog

Closed issues:

  • Changelog #29
  • Tag releases #16

Merged pull requests:

v3.3.0 (2015-04-15)

Full Changelog

Closed issues:

  • AuthenticationEndpoints should be independent of the V1/V2 API #20
  • Typo in AuthenticationEndpoints.login #17
  • Remove generated docs #14
  • Remove the examples directory from this repository #4

Merged pull requests:

v3.2.0 (2015-04-14)

Merged pull requests:

* This Change Log was automatically generated by github_changelog_generator