Release v6.8.0 (#902)

⚠️ **Breaking Changes**
- `management.experimentation.experiments.update_status()` and
`management.experimentation.feature_flags.update_status()` removed along
with `UpdateExperimentStatusResponseContent` and
`UpdateFeatureFlagStatusResponseContent`. Set status through `update(id,
status=...)` instead. `SearchOrganization.metadata` removed.
`ConnectionResponseCommon` no longer extends `CreateConnectionCommon`
and requires `display_name`, though no endpoint returns this model.
Feature flag `variations.delete()` no longer maps HTTP 400 to
`BadRequestError`, so a 400 raises the base `ApiError`
[\#898](#898)
([fern-api[bot]](https://github.com/apps/fern-api))

**Added**
- Client profiles (`management.client_profiles`), CAPTCHA policies
(`management.attack_protection.captcha_policies`), client and client
grant search (`management.clients.search()`,
`management.client_grants.search()`), and dynamic CIMD registration in
tenant settings with per-client metadata status. Client
`enforce_anon_session_transfer_network_binding` setting, `oidc_support`
on `clients.update()`, tenant `dpop_strict_refresh_token_binding`
setting, brute force protection `form_submission_mode`, `status` on
experiments, feature flags, and segments, Google Workspace provisioning
and directory sync on connection profiles, organization member access
level on organization connection events, and the passkey Guardian factor
[\#898](#898)
([fern-api[bot]](https://github.com/apps/fern-api))

**Changed**
- `management.clients.register_cimd_client()` raises `ConflictError` on
HTTP 409 instead of `ApiError`. `ConflictError` subclasses `ApiError`,
so existing handlers still catch it. Role `owner_id` filter and response
fields are typed as `RoleOwnerIdFilter` and `RoleOwnerId` string
aliases. `a0stream` is now optional on connection, group, organization,
and user cloud event types
[\#898](#898)
([fern-api[bot]](https://github.com/apps/fern-api))

**Fixed**
- `ManagementClient` and `AsyncManagementClient` now expose `agents`,
`client_profiles`, `connection_profiles`, `events`, `experimentation`,
`groups`, `rate_limit_policies`, `risk_assessments`, and
`user_attribute_profiles`, which previously raised `AttributeError`
[\#901](#901)
([developerkunal](https://github.com/developerkunal))

[fern-generated] SDK regeneration

Release v6.7.0 (#896)

⚠️ **Breaking Changes**
- `management.organizations.organization_template` sub-client removed
along with six types (`OrganizationTemplate`,
`OrganizationTemplateAllowedStrategyEnum`,
`OrganizationTemplateRoleVisibilityEnum`,
`OrganizationTemplateRoleVisibilityOverride`,
`OrganizationTemplateRoleVisibilityPolicy`,
`OrganizationTemplateUseForOrganizationDiscovery`).
`ConnectionDeletionBehaviorEnum` and `OrganizationDeletionBehaviorEnum`
also removed from the public surface
[\#894](#894)
([fern-api[bot]](https://github.com/apps/fern-api))

**Added**
- Experiment Center CRUD sub-clients for experiments
(`management.experimentation.experiments`), feature flags
(`management.experimentation.feature_flags`), segments
(`management.experimentation.segments`), and variations
(`management.experimentation.feature_flags.variations`). Resource server
`require_consent_non_repudiation` flag, client `oidc_support` parameter,
connection `thumbprints_sha_384` field, new `OauthScope` experimentation
values, and `ClientOidcBackchannelLogoutInitiatorsEnum.profile-changed`
[\#894](#894)
([fern-api[bot]](https://github.com/apps/fern-api))

Release v6.6.0 (#893)

**Added**
- Organization connection member access level, resource server access
token configuration, and client My Organization enforcement settings
[\#892](#892)
([fern-api[bot]](https://github.com/apps/fern-api))

Release v6.5.0 (#891)

⚠️ **Breaking Changes**
- `management.organization_templates` client removed along with
`ListOrganizationTemplatesPaginatedResponseContent` and
`OrganizationTemplateAssignedOrganization`. Four connection providers
dropped the `-mcp` suffix (`asana-mcp` becomes `asana`, `atlassian-mcp`
becomes `atlassian`, `gitlab-mcp` becomes `gitlab`, `slack-mcp` becomes
`slack`) and nine values removed entirely (`docusign-mcp`, `figma-mcp`,
`gusto-mcp`, `heroku-mcp`, `intercom-mcp`, `pagerduty-mcp`,
`supabase-mcp`, `vercel-mcp`, `xero-mcp`)
[\#890](#890)
([fern-api[bot]](https://github.com/apps/fern-api))

**Added**
- Guardian MFA settings (`GET`/`PUT /api/v2/guardian/settings`), email
and phone factor settings, organizations search, resource servers
search, experimentation client, anonymous sessions support on clients
and tenant settings, resource server anonymous access token
configuration, and `GatewayTimeoutError` for HTTP 504
[\#890](#890)
([fern-api[bot]](https://github.com/apps/fern-api))

Release v6.4.0 (#889)

⚠️ **Breaking Changes**
- Client `app_type` `b2b_integration` removed (configure via
`b2b_integration_configuration` instead);
`EventStreamCloudEventContextTenant.tenant_id` renamed to `id`
[\#888](#888)
([fern-api[bot]](https://github.com/apps/fern-api))

**Added**
- Organization templates client, client B2B integration configuration,
network ACL HTTP message signatures and key deletion, connection profile
SCIM provisioning, OIDC/Okta pushed authorization request support, SAML
`discovery_url`/`oidc_metadata`/`cross_app_access_resource_app` options,
tenant `local_resource_discovery` flag, forms `server_key`,
`post-credential-validation` action trigger and `consent-tenant-scopes`
screen group, and `UnprocessableEntityError` for HTTP 422
[\#888](#888)
([fern-api[bot]](https://github.com/apps/fern-api))

**Fixed**
- Raw `management.connections` client now surfaces 422 errors; raw
`management.connections.scim_configuration` now surfaces 409 errors;
`management.users.organizations.list` docstring updated for checkpoint
pagination [\#888](#888)
([fern-api[bot]](https://github.com/apps/fern-api))

Release 6.3.0 (#887)

**Added**
- feat: Add My Organization client access control, Connection Profile
Cross-App Access support, Network ACL keys management, and OIDC
space-delimited scope support
[\#886](#886)
([fern-api[bot]](https://github.com/apps/fern-api))

**Fixed**
- fix: Raw clients for forms and flows now surface additional error
responses instead of failing unhandled, corrected a docstring field name
[\#886](#886)
([fern-api[bot]](https://github.com/apps/fern-api))

Release 6.2.0 (#885)

**Added**
- feat: Add agents management, organization-client associations,
organization-level roles (groups/members), network ACL keys, and
directory provisioning group sync selections
[\#881](#881)
([fern-api[bot]](https://github.com/apps/fern-api))

**Fixed**
- fix: `EventStreamCloudEvent.data` now deserializes as its actual
object shape (`Dict[str, Any]`) instead of an opaque JSON-encoded string
that callers had to `json.loads()` themselves.
[\#881](#881)
([fern-api[bot]](https://github.com/apps/fern-api))

Release 6.1.0 (#878)

**Added**
- feat: Cross App Access (ID-JAG), branding theme identifiers,
Self-Service Enterprise Configuration third-party client access, session
actor [\#877](#877)
([fern-api[bot]](https://github.com/apps/fern-api))

Release PR for v6.0.0 (#875)

### Changes

Note: As this is a major release it is recommended to understand the
`Breaking Changes` section before upgrading. The
[UPGRADING.md](https://github.com/auth0/auth0-python/blob/master/UPGRADING.md)
will help better understand on the upgrade process.

### ⚠️ Breaking Changes

- `ConnectionAttributeIdentifier` removed (no compatibility alias);
split into three types. The `identifier` field on each attribute now
points to its own type:
- `EmailAttribute.identifier`: `EmailAttributeIdentifier` — `{active?,
default_method?: DefaultMethodEmailIdentifierEnum}` (same shape as the
old type; use this as the drop-in replacement).
- `PhoneAttribute.identifier`: `PhoneAttributeIdentifier` — `{active?,
default_method?: DefaultMethodPhoneNumberIdentifierEnum}`.
- `UsernameAttribute.identifier`: `UsernameAttributeIdentifier` —
`{active?}` (no `default_method`).
- `PhoneProviderProtectionBackoffStrategyEnum`: `Literal["exponential",
"none"]` → `Literal["exponential", "default"]`. Replace the value
`"none"` with `"default"`.
- `ListRolesOffsetPaginatedResponseContent.start` / `.limit` / `.total`:
`Optional[float] = None` → required `float`. Deserializing a role-list
response missing any of these now raises `pydantic.ValidationError`.
- **Federated Connections Tokensets removed** — the
`users.federated_connections_tokensets` client and its `list`/`delete`
methods are removed, along with the `FederatedConnectionTokenSet` and
`ConnectionFederatedConnectionsAccessTokens` types.
- **`federated_connections_access_tokens` field removed** — this
optional field is no longer present on `ConnectionOptionsAzureAd`,
`ConnectionOptionsCommonOidc`, `ConnectionOptionsGoogleApps`,
`ConnectionPropertiesOptions`, and `UpdateConnectionOptions`.
- **OAuth scopes removed** — `read:federated_connections_tokens` and
`delete:federated_connections_tokens` are no longer valid values of
`OauthScope`.
- **`ClientSessionTransferDelegationDeviceBindingEnum` narrowed** — the
`"asn"` value is removed; the enum now only accepts `"ip"`.

### New Endpoints

- `organizations.roles.members.list(id=..., role_id=...)` (sync + async)
→ `GET /api/v2/organizations/{id}/roles/{role_id}/members`. New
sub-clients `organizations.roles` and `organizations.roles.members`;
response type `ListOrganizationRoleMembersResponseContent`, item type
`RoleMember`.

### Type Changes/Features

- Organizations: `third_party_client_access:
Optional[OrganizationThirdPartyClientAccessEnum]` (`Literal["block",
"allow"]`) on `create()`/`update()` and all organization response types.
- Organizations: new types `ListOrganizationRoleMembersResponseContent`
and `RoleMember` (returned by the role-members endpoint above).
- Grants: new `UserGrant.organization_id: Optional[str]` (read-only),
via `GET /grants`.
- Connections: `discovery_url` / `oidc_metadata` extended to `samlp`
connections (previously OIDC-only), via new `ConnectionsDiscoveryUrl` /
`ConnectionsOidcMetadata` on `ConnectionPropertiesOptions` and
`UpdateConnectionOptions`.
- Event Streams: new event-type values `connection.created`,
`connection.deleted`, `connection.updated` on
`EventStreamEventTypeEnum`, `EventStreamDeliveryEventTypeEnum`,
`EventStreamSubscribeEventsEventTypeEnum`,
`EventStreamTestEventTypeEnum`; new
`EventStreamCloudEventConnection{Created,Deleted,Updated}*` payload
types; new `EventStreamSubscribeEventsResponseContent`.
- Token Vault: new `grants:
Optional[List[TokenVaultPrivilegedAccessGrant]]` on the
privileged-access credential/public-key types.
`TokenVaultPrivilegedAccessGrant`: `{connection: str, scopes:
List[str]}`.
- New error body types: `NotFoundErrorBody`/`NotFoundErrorBodyError`,
`TooManyRequestsErrorBody`/`TooManyRequestsErrorBodyError`.
- CloudEvent `specversion`: `str` →
`EventStreamCloudEventSpecVersionEnum` (`Literal["1.0"]` + `Any`
fallback) across group/org/user CloudEvent types.
- **`NetworkAclMatch`** — new optional `auth0_managed:
Optional[List[str]]` field (serialized as `auth0_managed`), available on
both the `match` and `not_match` rule blocks. This lets network ACL
rules reference Auth0-managed lists when matching or excluding traffic.