From 26c92950de406c9f2eddcf8d268e7b9b2b9973e4 Mon Sep 17 00:00:00 2001 From: Kunal Dawar Date: Wed, 14 Oct 2026 15:40:18 +0530 Subject: [PATCH 1/2] Restore Auth0 telemetry headers in client wrapper The regenerated wrapper dropped the Auth0-Client and User-Agent headers because the replay patches list is empty. This restores the Auth0 version of get_headers() from master. --- src/auth0/management/core/client_wrapper.py | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/src/auth0/management/core/client_wrapper.py b/src/auth0/management/core/client_wrapper.py index abce2c81..fd991f52 100644 --- a/src/auth0/management/core/client_wrapper.py +++ b/src/auth0/management/core/client_wrapper.py @@ -1,6 +1,11 @@ # This file was auto-generated by Fern from our API Definition. +# Modified by Auth0 to use Auth0 telemetry format with dynamic versioning +import base64 +import platform +import sys import typing +from json import dumps import httpx from .http_client import AsyncHttpClient, HttpClient @@ -30,7 +35,18 @@ def __init__( self._logging = logging def get_headers(self) -> typing.Dict[str, str]: + py_version = platform.python_version() + version = sys.modules["auth0"].__version__ + + auth0_client = dumps({ + "name": "auth0-python", + "version": version, + "env": {"python": py_version} + }).encode("utf-8") + headers: typing.Dict[str, str] = { + "User-Agent": f"Python/{py_version}", + "Auth0-Client": base64.b64encode(auth0_client).decode(), **(self.get_custom_headers() or {}), } headers["Authorization"] = f"Bearer {self._get_token()}" From 9b827b5f2370deb31bb3ccc4b5b9d3418142a66b Mon Sep 17 00:00:00 2001 From: Kunal Dawar Date: Wed, 14 Oct 2026 15:42:19 +0530 Subject: [PATCH 2/2] Keep UPGRADING.md out of Fern generation Add UPGRADING.md to .fernignore so generation does not remove the v6 migration guide, and restore the file from master. --- .fernignore | 1 + UPGRADING.md | 157 +++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 158 insertions(+) create mode 100644 UPGRADING.md diff --git a/.fernignore b/.fernignore index 6d1ab409..22bb7bf4 100644 --- a/.fernignore +++ b/.fernignore @@ -10,6 +10,7 @@ tests/management/ # Documentation v5_MIGRATION_GUIDE.md +UPGRADING.md CHANGELOG.md # Authentication API (copied from auth0-python, not Fern-generated) diff --git a/UPGRADING.md b/UPGRADING.md new file mode 100644 index 00000000..ed653dbf --- /dev/null +++ b/UPGRADING.md @@ -0,0 +1,157 @@ +# v6 Migration Guide + +A guide to migrating the Auth0 Python SDK from v5 to v6. + +- [Overall changes](#overall-changes) +- [Breaking changes](#breaking-changes) + - [Federated connections tokensets removed](#federated-connections-tokensets-removed) + - [`federated_connections_access_tokens` field removed](#federated_connections_access_tokens-field-removed) + - [`read:federated_connections_tokens` / `delete:federated_connections_tokens` scopes removed](#readfederated_connections_tokens--deletefederated_connections_tokens-scopes-removed) + - [`ClientSessionTransferDelegationDeviceBindingEnum` narrowed](#clientsessiontransferdelegationdevicebindingenum-narrowed) + - [`ConnectionAttributeIdentifier` split into three types](#connectionattributeidentifier-split-into-three-types) + - [`PhoneProviderProtectionBackoffStrategyEnum` value renamed](#phoneproviderprotectionbackoffstrategyenum-value-renamed) + - [`ListRolesOffsetPaginatedResponseContent` pagination fields now required](#listrolesoffsetpaginatedresponsecontent-pagination-fields-now-required) + +## Overall changes + +v6 removes one deprecated Management API surface (federated connections +tokensets) and tightens a handful of generated types to match the current +Auth0 Management API contract. Most applications will only be affected if +they use the specific types or endpoints listed below. + +The Authentication API is not affected by this release. + +## Breaking changes + +### Federated connections tokensets removed + +The `users.federated_connections_tokensets` sub-client and its `list`/`delete` +methods have been removed, along with the `FederatedConnectionTokenSet` and +`ConnectionFederatedConnectionsAccessTokens` types. This endpoint is no longer +part of the Auth0 Management API. + +```python +# v5 +client.users.federated_connections_tokensets.list(id="user_id") +client.users.federated_connections_tokensets.delete(id="user_id", tokenset_id="tokenset_id") +``` + +```python +# v6 +# No replacement — the endpoint has been removed from the Management API. +``` + +If you depend on this functionality, do not upgrade until you have confirmed +an alternative with Auth0 support. + +### `federated_connections_access_tokens` field removed + +The optional `federated_connections_access_tokens` field has been removed +from: + +- `ConnectionOptionsAzureAd` +- `ConnectionOptionsCommonOidc` +- `ConnectionOptionsGoogleApps` +- `ConnectionPropertiesOptions` +- `UpdateConnectionOptions` + +Any code reading or setting this field on the above types will need to +remove that usage. Note that these models are configured with +`extra="allow"`, so passing `federated_connections_access_tokens` is **not** +silently dropped — it is retained on the model and still serialized into the +outbound request. Remove the field explicitly rather than relying on the SDK +to strip it. + +### `read:federated_connections_tokens` / `delete:federated_connections_tokens` scopes removed + +These two values are no longer valid members of `OauthScope`. Remove any +references to them when requesting or checking scopes. + +### `ClientSessionTransferDelegationDeviceBindingEnum` narrowed + +The `"asn"` literal value has been removed. The enum now only accepts `"ip"`: + +```python +# v5 +ClientSessionTransferDelegationDeviceBindingEnum = typing.Union[typing.Literal["ip", "asn"], typing.Any] +``` + +```python +# v6 +ClientSessionTransferDelegationDeviceBindingEnum = typing.Union[typing.Literal["ip"], typing.Any] +``` + +If you were setting this value to `"asn"`, update it to `"ip"` — this matches +the current Management API's accepted values. + +### `ConnectionAttributeIdentifier` split into three types + +`ConnectionAttributeIdentifier` has been removed with no compatibility alias. +It is replaced by three narrower types, one per attribute: + +| Attribute field | v5 type | v6 type | Shape | +| --- | --- | --- | --- | +| `EmailAttribute.identifier` | `ConnectionAttributeIdentifier` | `EmailAttributeIdentifier` | `{active?, default_method?: DefaultMethodEmailIdentifierEnum}` | +| `PhoneAttribute.identifier` | `ConnectionAttributeIdentifier` | `PhoneAttributeIdentifier` | `{active?, default_method?: DefaultMethodPhoneNumberIdentifierEnum}` | +| `UsernameAttribute.identifier` | `ConnectionAttributeIdentifier` | `UsernameAttributeIdentifier` | `{active?}` (no `default_method`) | + +```python +# v5 +from auth0.management.types import ConnectionAttributeIdentifier + +identifier = ConnectionAttributeIdentifier(active=True, default_method="email_otp") +``` + +```python +# v6 +from auth0.management.types import EmailAttributeIdentifier + +identifier = EmailAttributeIdentifier(active=True, default_method="email_otp") +``` + +`EmailAttributeIdentifier` has the same shape as the old +`ConnectionAttributeIdentifier` and is a drop-in replacement for code that +was only ever used with `EmailAttribute`. Code using +`ConnectionAttributeIdentifier` with `PhoneAttribute` or `UsernameAttribute` +must switch to `PhoneAttributeIdentifier` or `UsernameAttributeIdentifier` +respectively; `UsernameAttributeIdentifier` does not support +`default_method`. + +### `PhoneProviderProtectionBackoffStrategyEnum` value renamed + +The `"none"` literal has been replaced with `"default"`: + +```python +# v5 +PhoneProviderProtectionBackoffStrategyEnum = typing.Union[typing.Literal["exponential", "none"], typing.Any] +``` + +```python +# v6 +PhoneProviderProtectionBackoffStrategyEnum = typing.Union[typing.Literal["exponential", "default"], typing.Any] +``` + +Replace any use of `"none"` with `"default"`. + +### `ListRolesOffsetPaginatedResponseContent` pagination fields now required + +`start`, `limit`, and `total` are no longer optional: + +```python +# v5 +start: typing.Optional[float] = None +limit: typing.Optional[float] = None +total: typing.Optional[float] = None +``` + +```python +# v6 +start: float +limit: float +total: float +``` + +Deserializing a role-list response that is missing any of these fields now +raises `pydantic.ValidationError` instead of silently defaulting to `None`. +This matches the Management API, which always returns these fields for this +endpoint.