From 744381610e8171f21ab4e838b6657c1ca9fcb4b2 Mon Sep 17 00:00:00 2001
From: "workos-sdk-automation[bot]"
 <255426317+workos-sdk-automation[bot]@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:42:17 +0000
Subject: [PATCH 1/2] chore(generated): regenerate shared files for Agents

---
 .last-synced-sha                              |  2 +-
 .oagen-manifest.json                          |  8 +++
 lib/workos/agents.rb                          | 29 +++++++-
 ...blueprints_token_validate_token_request.rb | 18 +++++
 lib/workos/agents/agent_token_validation.rb   | 40 +++++++++++
 .../agent_blueprints_create_request.rbi       |  4 +-
 ...lueprints_token_validate_token_request.rbi | 24 +++++++
 rbi/workos/agent_token_validation.rbi         | 66 +++++++++++++++++++
 rbi/workos/agents.rbi                         | 13 +++-
 test/workos/test_agents.rb                    | 12 +++-
 test/workos/test_agents_model_round_trip.rb   | 34 ++++++++++
 11 files changed, 241 insertions(+), 9 deletions(-)
 create mode 100644 lib/workos/agents/agent_blueprints_token_validate_token_request.rb
 create mode 100644 lib/workos/agents/agent_token_validation.rb
 create mode 100644 rbi/workos/agent_blueprints_token_validate_token_request.rbi
 create mode 100644 rbi/workos/agent_token_validation.rbi

diff --git a/.last-synced-sha b/.last-synced-sha
index 0f267924..d20a1099 100644
--- a/.last-synced-sha
+++ b/.last-synced-sha
@@ -1 +1 @@
-d61348070f219d16b6285f205986c2d332bf6e9c
+edb560e2be3f54b668ea8d11fa5a060c87ab5087
diff --git a/.oagen-manifest.json b/.oagen-manifest.json
index 196ee6f7..a754946b 100644
--- a/.oagen-manifest.json
+++ b/.oagen-manifest.json
@@ -17,6 +17,7 @@
     "lib/workos/agents/agent_blueprints_create_request_invocable_by.rb",
     "lib/workos/agents/agent_blueprints_create_request_session_setting.rb",
     "lib/workos/agents/agent_blueprints_token_mint_token_request.rb",
+    "lib/workos/agents/agent_blueprints_token_validate_token_request.rb",
     "lib/workos/agents/agent_blueprints_update_request.rb",
     "lib/workos/agents/agent_blueprints_update_request_invocable_by.rb",
     "lib/workos/agents/agent_blueprints_update_request_session_setting.rb",
@@ -28,6 +29,7 @@
     "lib/workos/agents/agent_registration_claim.rb",
     "lib/workos/agents/agent_registration_claim_claim_completion.rb",
     "lib/workos/agents/agent_token.rb",
+    "lib/workos/agents/agent_token_validation.rb",
     "lib/workos/agents/claim_view_response.rb",
     "lib/workos/agents/claim_view_response_organization.rb",
     "lib/workos/api_keys.rb",
@@ -819,6 +821,7 @@
     "rbi/workos/agent_blueprints_create_request_invocable_by.rbi",
     "rbi/workos/agent_blueprints_create_request_session_setting.rbi",
     "rbi/workos/agent_blueprints_token_mint_token_request.rbi",
+    "rbi/workos/agent_blueprints_token_validate_token_request.rbi",
     "rbi/workos/agent_blueprints_update_request.rbi",
     "rbi/workos/agent_blueprints_update_request_invocable_by.rbi",
     "rbi/workos/agent_blueprints_update_request_session_setting.rbi",
@@ -859,6 +862,7 @@
     "rbi/workos/agent_registration_revoked.rbi",
     "rbi/workos/agent_registration_revoked_data.rbi",
     "rbi/workos/agent_token.rbi",
+    "rbi/workos/agent_token_validation.rbi",
     "rbi/workos/agents.rbi",
     "rbi/workos/api_key.rbi",
     "rbi/workos/api_key_created.rbi",
@@ -2501,6 +2505,10 @@
     "POST /user_management/waitlists/{id}/entries": {
       "sdkMethod": "create_waitlist_entry",
       "service": "user_management"
+    },
+    "POST /agents/blueprints/{agent_blueprint_id}/tokens/validate": {
+      "sdkMethod": "validate_blueprint_token",
+      "service": "agents"
     }
   }
 }
diff --git a/lib/workos/agents.rb b/lib/workos/agents.rb
index b9ce868c..941bca1e 100644
--- a/lib/workos/agents.rb
+++ b/lib/workos/agents.rb
@@ -59,15 +59,15 @@ def list_blueprints(
     # @param description [String, nil] Human-readable description of the agent blueprint.
     # @param permissions [Array<String>, nil] Permission slugs forming the ceiling on what sessions minted from this blueprint may do. Each slug must exist in the environment.
     # @param invocable_by [WorkOS::AgentBlueprintsCreateRequestInvocableBy, nil] Who may mint sessions from this blueprint.
-    # @param session_settings [WorkOS::AgentBlueprintsCreateRequestSessionSetting] Token and session lifetimes for sessions minted from this blueprint.
+    # @param session_settings [WorkOS::AgentBlueprintsCreateRequestSessionSetting, nil] Token and session lifetimes for sessions minted from this blueprint.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AgentBlueprint]
     def create_blueprint(
       name:,
-      session_settings:,
       description: nil,
       permissions: nil,
       invocable_by: nil,
+      session_settings: nil,
       request_options: {}
     )
       body = {
@@ -202,6 +202,31 @@ def create_blueprint_token(
       result
     end
 
+    # Validate an agent token
+    # @param agent_blueprint_id [String] The unique ID of the agent blueprint.
+    # @param agent_access_token [String] The agent access token (a JWT) to validate.
+    # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
+    # @return [WorkOS::AgentTokenValidation]
+    def validate_blueprint_token(
+      agent_blueprint_id:,
+      agent_access_token:,
+      request_options: {}
+    )
+      body = {
+        "agent_access_token" => agent_access_token
+      }
+      response = @client.request(
+        method: :post,
+        path: "/agents/blueprints/#{WorkOS::Util.encode_path(agent_blueprint_id)}/tokens/validate",
+        auth: true,
+        body: body,
+        request_options: request_options
+      )
+      result = WorkOS::AgentTokenValidation.new(response.body)
+      result.last_response = WorkOS::Types::ApiResponse.new(http_status: response.code.to_i, http_headers: response.each_header.to_h, request_id: response["x-request-id"])
+      result
+    end
+
     # Link a claim attempt to an external user
     # @param type [String] The operation to perform on the claim attempt. Currently only `link_external_user` is supported.
     # @param claim_attempt_token [String] The token identifying the claim attempt.
diff --git a/lib/workos/agents/agent_blueprints_token_validate_token_request.rb b/lib/workos/agents/agent_blueprints_token_validate_token_request.rb
new file mode 100644
index 00000000..e0108f1d
--- /dev/null
+++ b/lib/workos/agents/agent_blueprints_token_validate_token_request.rb
@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentBlueprintsTokenValidateTokenRequest < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      agent_access_token: :agent_access_token
+    }.freeze
+
+    attr_accessor :agent_access_token
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @agent_access_token = hash[:agent_access_token]
+    end
+  end
+end
diff --git a/lib/workos/agents/agent_token_validation.rb b/lib/workos/agents/agent_token_validation.rb
new file mode 100644
index 00000000..456c4fb9
--- /dev/null
+++ b/lib/workos/agents/agent_token_validation.rb
@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+module WorkOS
+  class AgentTokenValidation < WorkOS::Types::BaseModel
+    HASH_ATTRS = {
+      valid: :valid,
+      agent_instance_id: :agent_instance_id,
+      agent_instance_session_id: :agent_instance_session_id,
+      organization_id: :organization_id,
+      permissions: :permissions,
+      intent: :intent,
+      acting_user_id: :acting_user_id,
+      session_expires_at: :session_expires_at
+    }.freeze
+
+    attr_accessor \
+      :valid,
+      :agent_instance_id,
+      :agent_instance_session_id,
+      :organization_id,
+      :permissions,
+      :intent,
+      :acting_user_id,
+      :session_expires_at
+
+    def initialize(json)
+      hash = self.class.normalize(json)
+      @valid = hash[:valid]
+      @agent_instance_id = hash[:agent_instance_id]
+      @agent_instance_session_id = hash[:agent_instance_session_id]
+      @organization_id = hash[:organization_id]
+      @permissions = hash[:permissions] || []
+      @intent = hash[:intent]
+      @acting_user_id = hash[:acting_user_id]
+      @session_expires_at = hash[:session_expires_at]
+    end
+  end
+end
diff --git a/rbi/workos/agent_blueprints_create_request.rbi b/rbi/workos/agent_blueprints_create_request.rbi
index 434e11ea..6d629fd4 100644
--- a/rbi/workos/agent_blueprints_create_request.rbi
+++ b/rbi/workos/agent_blueprints_create_request.rbi
@@ -33,10 +33,10 @@ module WorkOS
     sig { params(value: T.nilable(WorkOS::AgentBlueprintsCreateRequestInvocableBy)).returns(T.nilable(WorkOS::AgentBlueprintsCreateRequestInvocableBy)) }
     def invocable_by=(value); end
 
-    sig { returns(WorkOS::AgentBlueprintsCreateRequestSessionSetting) }
+    sig { returns(T.nilable(WorkOS::AgentBlueprintsCreateRequestSessionSetting)) }
     def session_settings; end
 
-    sig { params(value: WorkOS::AgentBlueprintsCreateRequestSessionSetting).returns(WorkOS::AgentBlueprintsCreateRequestSessionSetting) }
+    sig { params(value: T.nilable(WorkOS::AgentBlueprintsCreateRequestSessionSetting)).returns(T.nilable(WorkOS::AgentBlueprintsCreateRequestSessionSetting)) }
     def session_settings=(value); end
 
     sig { returns(T::Hash[Symbol, T.untyped]) }
diff --git a/rbi/workos/agent_blueprints_token_validate_token_request.rbi b/rbi/workos/agent_blueprints_token_validate_token_request.rbi
new file mode 100644
index 00000000..3c402c61
--- /dev/null
+++ b/rbi/workos/agent_blueprints_token_validate_token_request.rbi
@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+# typed: strong
+
+module WorkOS
+  class AgentBlueprintsTokenValidateTokenRequest
+    sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
+    def initialize(json); end
+
+    sig { returns(String) }
+    def agent_access_token; end
+
+    sig { params(value: String).returns(String) }
+    def agent_access_token=(value); end
+
+    sig { returns(T::Hash[Symbol, T.untyped]) }
+    def to_h; end
+
+    sig { params(args: T.untyped).returns(String) }
+    def to_json(*args); end
+  end
+end
diff --git a/rbi/workos/agent_token_validation.rbi b/rbi/workos/agent_token_validation.rbi
new file mode 100644
index 00000000..ac40bd0c
--- /dev/null
+++ b/rbi/workos/agent_token_validation.rbi
@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+# This file is auto-generated by oagen. Do not edit.
+
+# typed: strong
+
+module WorkOS
+  class AgentTokenValidation
+    sig { params(json: T.any(String, T::Hash[Symbol, T.untyped])).void }
+    def initialize(json); end
+
+    sig { returns(T::Boolean) }
+    def valid; end
+
+    sig { params(value: T::Boolean).returns(T::Boolean) }
+    def valid=(value); end
+
+    sig { returns(String) }
+    def agent_instance_id; end
+
+    sig { params(value: String).returns(String) }
+    def agent_instance_id=(value); end
+
+    sig { returns(String) }
+    def agent_instance_session_id; end
+
+    sig { params(value: String).returns(String) }
+    def agent_instance_session_id=(value); end
+
+    sig { returns(String) }
+    def organization_id; end
+
+    sig { params(value: String).returns(String) }
+    def organization_id=(value); end
+
+    sig { returns(T::Array[String]) }
+    def permissions; end
+
+    sig { params(value: T::Array[String]).returns(T::Array[String]) }
+    def permissions=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def intent; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def intent=(value); end
+
+    sig { returns(T.nilable(String)) }
+    def acting_user_id; end
+
+    sig { params(value: T.nilable(String)).returns(T.nilable(String)) }
+    def acting_user_id=(value); end
+
+    sig { returns(String) }
+    def session_expires_at; end
+
+    sig { params(value: String).returns(String) }
+    def session_expires_at=(value); end
+
+    sig { returns(T::Hash[Symbol, T.untyped]) }
+    def to_h; end
+
+    sig { params(args: T.untyped).returns(String) }
+    def to_json(*args); end
+  end
+end
diff --git a/rbi/workos/agents.rbi b/rbi/workos/agents.rbi
index b2530e8b..67df22ef 100644
--- a/rbi/workos/agents.rbi
+++ b/rbi/workos/agents.rbi
@@ -23,14 +23,14 @@ module WorkOS
     sig do
       params(
         name: String,
-        session_settings: WorkOS::AgentBlueprintsCreateRequestSessionSetting,
         description: T.nilable(String),
         permissions: T.nilable(T::Array[String]),
         invocable_by: T.nilable(WorkOS::AgentBlueprintsCreateRequestInvocableBy),
+        session_settings: T.nilable(WorkOS::AgentBlueprintsCreateRequestSessionSetting),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::AgentBlueprint)
     end
-    def create_blueprint(name:, session_settings:, description:, permissions:, invocable_by:, request_options:); end
+    def create_blueprint(name:, description:, permissions:, invocable_by:, session_settings:, request_options:); end
 
     sig do
       params(
@@ -75,6 +75,15 @@ module WorkOS
     end
     def create_blueprint_token(agent_blueprint_id:, type:, user_access_token:, intent:, organization_id:, agent_access_token:, refresh_token:, request_options:); end
 
+    sig do
+      params(
+        agent_blueprint_id: String,
+        agent_access_token: String,
+        request_options: T::Hash[Symbol, T.untyped]
+      ).returns(WorkOS::AgentTokenValidation)
+    end
+    def validate_blueprint_token(agent_blueprint_id:, agent_access_token:, request_options:); end
+
     sig do
       params(
         type: String,
diff --git a/test/workos/test_agents.rb b/test/workos/test_agents.rb
index dae8846b..d2aeef52 100644
--- a/test/workos/test_agents.rb
+++ b/test/workos/test_agents.rb
@@ -21,7 +21,7 @@ def test_list_blueprints_returns_expected_result
   def test_create_blueprint_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/agents/blueprints(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.agents.create_blueprint(name: "stub", session_settings: {})
+    result = @client.agents.create_blueprint(name: "stub")
     refute_nil result
   end
 
@@ -53,6 +53,13 @@ def test_create_blueprint_token_returns_expected_result
     refute_nil result
   end
 
+  def test_validate_blueprint_token_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/agents/blueprints/stub/tokens/validate(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.agents.validate_blueprint_token(agent_blueprint_id: "stub", agent_access_token: "stub")
+    refute_nil result
+  end
+
   def test_update_attempts_returns_expected_result
     stub_request(:patch, %r{\Ahttps://api\.workos\.com/agents/claims/attempts(\?|\z)})
       .to_return(body: "{}", status: 200)
@@ -119,11 +126,12 @@ def test_revoke_session_returns_expected_result
   # Parameterized authentication error tests (one per endpoint).
   [
     {name: :list_blueprints, verb: :get, url: %r{\Ahttps://api\.workos\.com/agents/blueprints(\?|\z)}},
-    {name: :create_blueprint, verb: :post, url: %r{\Ahttps://api\.workos\.com/agents/blueprints(\?|\z)}, args: {name: "stub", session_settings: {}}},
+    {name: :create_blueprint, verb: :post, url: %r{\Ahttps://api\.workos\.com/agents/blueprints(\?|\z)}, args: {name: "stub"}},
     {name: :get_blueprint, verb: :get, url: %r{\Ahttps://api\.workos\.com/agents/blueprints/stub(\?|\z)}, args: {agent_blueprint_id: "stub"}},
     {name: :update_blueprint, verb: :patch, url: %r{\Ahttps://api\.workos\.com/agents/blueprints/stub(\?|\z)}, args: {agent_blueprint_id: "stub"}},
     {name: :delete_blueprint, verb: :delete, url: %r{\Ahttps://api\.workos\.com/agents/blueprints/stub(\?|\z)}, args: {agent_blueprint_id: "stub"}},
     {name: :create_blueprint_token, verb: :post, url: %r{\Ahttps://api\.workos\.com/agents/blueprints/stub/tokens(\?|\z)}, args: {agent_blueprint_id: "stub", type: "stub"}},
+    {name: :validate_blueprint_token, verb: :post, url: %r{\Ahttps://api\.workos\.com/agents/blueprints/stub/tokens/validate(\?|\z)}, args: {agent_blueprint_id: "stub", agent_access_token: "stub"}},
     {name: :update_attempts, verb: :patch, url: %r{\Ahttps://api\.workos\.com/agents/claims/attempts(\?|\z)}, args: {type: "link_external_user", claim_attempt_token: "stub", user: {}}},
     {name: :create_validate, verb: :post, url: %r{\Ahttps://api\.workos\.com/agents/credentials/validate(\?|\z)}, args: {type: "stub", credential: "stub"}},
     {name: :get_registration, verb: :get, url: %r{\Ahttps://api\.workos\.com/agents/registrations/stub(\?|\z)}, args: {id: "stub"}},
diff --git a/test/workos/test_agents_model_round_trip.rb b/test/workos/test_agents_model_round_trip.rb
index ac72a90a..1ce433ae 100644
--- a/test/workos/test_agents_model_round_trip.rb
+++ b/test/workos/test_agents_model_round_trip.rb
@@ -125,6 +125,29 @@ def test_agent_token_round_trip
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_agent_token_validation_round_trip
+    fixture = {
+      "valid" => true,
+      "agent_instance_id" => "stub",
+      "agent_instance_session_id" => "stub",
+      "organization_id" => "stub",
+      "permissions" => [],
+      "intent" => nil,
+      "acting_user_id" => nil,
+      "session_expires_at" => "stub"
+    }
+    model = WorkOS::AgentTokenValidation.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["agent_instance_id"], json[:agent_instance_id]
+    assert_equal fixture["agent_instance_session_id"], json[:agent_instance_session_id]
+    assert_equal fixture["organization_id"], json[:organization_id]
+    assert_nil json[:intent]
+    assert_nil json[:acting_user_id]
+    assert_equal fixture["session_expires_at"], json[:session_expires_at]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_agent_instance_session_round_trip
     fixture = {
       "object" => "agent_instance_session",
@@ -315,6 +338,17 @@ def test_agent_blueprints_token_mint_token_request_round_trip
     fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
   end
 
+  def test_agent_blueprints_token_validate_token_request_round_trip
+    fixture = {
+      "agent_access_token" => "stub"
+    }
+    model = WorkOS::AgentBlueprintsTokenValidateTokenRequest.new(fixture.to_json)
+    json = model.to_h
+    assert_kind_of Hash, json
+    assert_equal fixture["agent_access_token"], json[:agent_access_token]
+    fixture.each_key { |k| assert json.key?(k.to_sym) || json.key?(k), "Expected to_h to include key #{k}" }
+  end
+
   def test_agent_admin_link_claim_attempt_to_external_user_request_round_trip
     fixture = {
       "type" => "link_external_user",

From c5fd334d92fb4367958249edae8eec2e37196cd0 Mon Sep 17 00:00:00 2001
From: "workos-sdk-automation[bot]"
 <255426317+workos-sdk-automation[bot]@users.noreply.github.com>
Date: Tue, 1 Sep 2026 21:42:22 +0000
Subject: [PATCH 2/2] chore(generated): add release notes fragment

---
 ...T21-42-22-b6350ef365d412ae1775ac389c8d8e4ad8c20734.md | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 .changelog-pending/2026-09-01T21-42-22-b6350ef365d412ae1775ac389c8d8e4ad8c20734.md

diff --git a/.changelog-pending/2026-09-01T21-42-22-b6350ef365d412ae1775ac389c8d8e4ad8c20734.md b/.changelog-pending/2026-09-01T21-42-22-b6350ef365d412ae1775ac389c8d8e4ad8c20734.md
new file mode 100644
index 00000000..c89a6b84
--- /dev/null
+++ b/.changelog-pending/2026-09-01T21-42-22-b6350ef365d412ae1775ac389c8d8e4ad8c20734.md
@@ -0,0 +1,9 @@
+* [#549](https://github.com/workos/workos-ruby/pull/549) fix(generated): regenerate from spec
+
+  **Features**
+  * **[agents](https://workos.com/docs/reference/agents)**:
+    * Made `AgentBlueprintsCreateRequest.session_settings` optional
+    * Added model `AgentTokenValidation`
+    * Added model `AgentBlueprintsTokenValidateTokenRequest`
+  * **agents_blueprints_tokens**:
+    * Added endpoint `POST /agents/blueprints/{agent_blueprint_id}/tokens/validate`