mgmt-10.4.0

⚠️ BREAKING CHANGES

Organizations.OrganizationTemplate sub-client removed - #1117 (fern-api[bot])

• The per-organization client.Organizations.OrganizationTemplate sub-client (added in mgmt-10.1.0) has been removed, along with its OrganizationTemplate model and OrganizationTemplateAllowedStrategyEnum. The OauthScope.ReadOrganizationTemplates scope (read:organization_templates) has been removed as well. Any code that references client.Organizations.OrganizationTemplate or that scope constant will fail to compile and must be removed.

Added

• Experiment Center (Early Access): Introduces a full experimentation surface under client.Experimentation for running A/B tests across authentication flows. client.Experimentation.Experiments now supports the complete lifecycle - ListAsync (checkpoint-paginated, filterable by status, authentication flow, and feature flag), CreateAsync, GetAsync, UpdateAsync, DeleteAsync, UpdateStatusAsync (transitioning through draft → active → paused → completed, with full readiness validation on activation), and ValidateAsync (a read-only readiness check returning is_valid and an errors list). Experiments support percentage and segment allocation strategies with per-variation weights, control/fallback flags, and priority ordering; gradual rollout via configurable exposure levels advanced one step at a time through AdvanceRampAsync; copy-on-activate feature-flag, variation, and segment snapshots captured on first activation; and an editable_fields list indicating which fields remain mutable for the experiment's current status #1117 (fern-api[bot])
• Experiment Center feature flags and segments: Two new sub-clients complete the experimentation entity model. client.Experimentation.FeatureFlags exposes ListAsync, CreateAsync, GetAsync, UpdateAsync, DeleteAsync, and UpdateStatusAsync, with a nested client.Experimentation.FeatureFlags.Variations sub-client (ListAsync, CreateAsync, GetAsync, UpdateAsync, DeleteAsync) for managing a flag's variations. client.Experimentation.Segments (ListAsync, CreateAsync, GetAsync, UpdateAsync, DeleteAsync) manages targeting segments with a rich match model - match/not-match conditions built from contains, starts-with, ends-with, and exists expressions #1117 (fern-api[bot])
• Experimentation OAuth scopes: Three new scopes are available for authorizing experimentation operations - OauthScope.CreateExperimentation (create:experimentation), OauthScope.ReadExperimentation (read:experimentation), and OauthScope.DeleteExperimentation (delete:experimentation) #1117 (fern-api[bot])
• Consent non-repudiation on resource servers: Resource servers now support a RequireConsentNonRepudiation boolean on create, update, and read (including list and search responses). When enabled, the authorization server rejects consent decisions that are not digitally signed, so an approver cannot later deny a consent they granted. Defaults to false; a configured value is still returned even after the related entitlement is disabled #1117 (fern-api[bot])
• OIDC support configuration on clients: Application client creation now accepts an OidcSupport block (ClientOidcSupportPost) that declares whether OIDC support is allowed and, when it is, either allows all scopes or restricts access to an explicit AllowedScopes list #1117 (fern-api[bot])
• Certificate thumbprints on SAML-family connections: SAML, AD, ADFS, Azure AD, PingFederate, and common SAML connection options now accept Thumbprints and ThumbprintsSha384 lists for pinning signing certificates by thumbprint #1117 (fern-api[bot])
• My-account async-approval notification channel: A new my-account value is available on the async-approval notifications channel enum #1117 (fern-api[bot])