Authorization Resources (external ID) endpoints and listResources endpoint by swaroopAkkineniWorkos · Pull Request #1472 · workos/workos-node

swaroopAkkineniWorkos · 2026-02-10T16:48:48Z

linear: https://linear.app/workos/issue/ENT-4372/sdk-updates

I decided to break up the work for ENT-4372 into a smaller pr's that we can be easily reviewed and merge them into ENT-4372-base-authorization-branch. Then we can have one final merge that merges ENT-4372-base-authorization-branch into the main.

desc: the goal of this pr is to implement the following endpoints in the node sdk.

listResources()               | GET /authorization/organizations/{org_id}/resources

getResourceByExternalId()     | GET /authorization/organizations/{org_id}/resources/{type}/{external_id}
updateResourceByExternalId()  | PATCH /authorization/organizations/{org_id}/resources/{type}/{external_id}
deleteResourceByExternalId()  | DELETE /authorization/organizations/{org_id}/resources/{type}/{external_id}

Each one will call the corresponding new fga endpoints within workos repo

listResources() ~ https://github.com/workos/workos/blob/51f5a445c3a247f5f093bfaae8e385629df56d36/packages/api/src/authorization-resources/authorization-resources.controller.ts#L83

getResourceByExternalId() ~ https://github.com/workos/workos/blob/51f5a445c3a247f5f093bfaae8e385629df56d36/packages/api/src/authorization-resources/authorization-resources-by-external-id.controller.ts#L90
updateResourceByExternalId() ~ https://github.com/workos/workos/blob/51f5a445c3a247f5f093bfaae8e385629df56d36/packages/api/src/authorization-resources/authorization-resources-by-external-id.controller.ts#L183
deleteResourceByExternalId() ~ https://github.com/workos/workos/blob/51f5a445c3a247f5f093bfaae8e385629df56d36/packages/api/src/authorization-resources/authorization-resources-by-external-id.controller.ts#L221

linear · 2026-02-10T16:48:52Z

ENT-4372 SDK Updates

swaroopAkkineniWorkos · 2026-02-10T18:16:10Z

@greptile can you plz do a first pass review

greptile-apps

_{11 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

Co-authored-by: Cursor <cursoragent@cursor.com>

greptile-apps

_{12 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

swaroopAkkineniWorkos · 2026-02-10T23:12:33Z

@greptile plz re-review this pr

greptile-apps · 2026-02-10T23:15:44Z

Greptile Overview

Greptile Summary

This PR implements four new authorization resource endpoints that enable operations using external IDs instead of internal resource IDs:

listResources() - Retrieves paginated list of resources with filtering by organization, resource type, parent resource, and search
getResourceByExternalId() - Fetches a specific resource by organization ID, resource type slug, and external ID
updateResourceByExternalId() - Updates resource name and/or description using external ID
deleteResourceByExternalId() - Deletes a resource using external ID

The implementation follows established patterns in the codebase with consistent serialization, proper TypeScript typing, and comprehensive test coverage. All new methods properly handle nullable fields (description, parent_resource_id) and use the existing deserialization utilities. The list endpoint includes pagination support with before/after cursors and array filters are correctly serialized as comma-separated strings.

Confidence Score: 5/5

This PR is safe to merge with minimal risk
The implementation follows existing patterns consistently, includes comprehensive test coverage with edge cases (null values, empty bodies, pagination), uses proper TypeScript types, and correctly handles serialization/deserialization. No security concerns, no breaking changes, and all custom rules are satisfied.
No files require special attention

Important Files Changed

Filename	Overview
src/authorization/authorization.ts	Added four new resource endpoints using external ID: `listResources()`, `getResourceByExternalId()`, `updateResourceByExternalId()`, and `deleteResourceByExternalId()` with consistent API patterns
src/authorization/authorization.spec.ts	Comprehensive test coverage for all new endpoints including edge cases, pagination, filters, and null handling
src/authorization/serializers/list-authorization-resources-options.serializer.ts	Serializer properly converts camelCase options to snake_case parameters and joins arrays into comma-separated strings
src/authorization/serializers/update-authorization-resource-by-external-id-options.serializer.ts	Serializer correctly handles optional `name` and `description` fields using `!== undefined` checks to allow null values
src/authorization/interfaces/list-authorization-resources-options.interface.ts	Interface properly extends `PaginationOptions` and defines array filters with corresponding snake_case serialized version

Sequence Diagram

sequenceDiagram
    participant Client
    participant SDK as WorkOS SDK
    participant Serializer
    participant API as WorkOS API

    Note over Client,API: List Resources Flow
    Client->>SDK: listResources(options)
    SDK->>Serializer: serializeListAuthorizationResourcesOptions()
    Serializer->>Serializer: Convert arrays to comma-separated strings
    Serializer->>Serializer: Convert camelCase to snake_case
    Serializer-->>SDK: serialized params
    SDK->>API: GET /authorization/resources?params
    API-->>SDK: AuthorizationResourceListResponse
    SDK->>SDK: deserializeAuthorizationResource() for each item
    SDK-->>Client: AuthorizationResourceList

    Note over Client,API: Get/Update/Delete by External ID Flow
    Client->>SDK: getResourceByExternalId({org, type, externalId})
    SDK->>API: GET /authorization/organizations/{org}/resources/{type}/{externalId}
    API-->>SDK: AuthorizationResourceResponse
    SDK->>SDK: deserializeAuthorizationResource()
    SDK-->>Client: AuthorizationResource

    Client->>SDK: updateResourceByExternalId(options)
    SDK->>Serializer: serializeUpdateResourceByExternalIdOptions()
    Serializer->>Serializer: Filter undefined fields
    Serializer-->>SDK: serialized body
    SDK->>API: PATCH /authorization/organizations/{org}/resources/{type}/{externalId}
    API-->>SDK: AuthorizationResourceResponse
    SDK->>SDK: deserializeAuthorizationResource()
    SDK-->>Client: AuthorizationResource

    Client->>SDK: deleteResourceByExternalId({org, type, externalId})
    SDK->>API: DELETE /authorization/organizations/{org}/resources/{type}/{externalId}
    API-->>SDK: 204 No Content
    SDK-->>Client: void

greptile-apps

_{12 files reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}

src/authorization/serializers/list-authorization-resources-options.serializer.ts

greptile-apps

_{12 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}

csrbarber · 2026-02-11T14:03:25Z

src/authorization/authorization.ts

    await this.workos.delete(`/authorization/resources/${resourceId}`);
  }
+
+  // part 2


Suggested change

// part 2

nicknisi · 2026-02-11T17:11:09Z

src/authorization/authorization.ts

+  ): Promise<AuthorizationResource> {
+    const { organizationId, resourceTypeSlug, externalId } = options;
+    const { data } = await this.workos.get<AuthorizationResourceResponse>(
+      `/authorization/organizations/${organizationId}/resources/${resourceTypeSlug}/${externalId}`,


suggestion: could externalId contain URL-significant characters? Not sure if this is gated elsewhere but could be good to wrap with encodeURIComponent.

atainter · 2026-02-11T19:56:04Z

src/authorization/interfaces/list-authorization-resources-options.interface.ts

+}
+
+export interface SerializedListAuthorizationResourcesOptions {
+  organization_ids?: string;


I have a ticket to change this and slugs to singular organization_id, resource_type_slug

https://linear.app/workos/issue/ENT-5193/list-resources-change-plural-keys-to-singular

I'll update with a change once it is merged

atainter · 2026-02-11T19:57:32Z

src/authorization/interfaces/authorization-resource.interface.ts

@@ -31,8 +31,6 @@ export interface CreateAuthorizationResourceOptions {
  resourceTypeSlug: string;
  organizationId: string;
  parentResourceId?: string | null;


Same comment about type_slug + external_id

Adding these endpoints to the sdk #1471 ``` getResource() ~ GET /authorization/resources/{resource_id} createResource() ~ POST /authorization/resources updateResource() ~ PATCH /authorization/resources/{resource_id} deleteResource() ~ DELETE /authorization/resources/{resource_id} ``` #1473 ``` check() | POST /authorization/organization_memberships/{om_id}/check ``` #1472 ``` listResources() | GET /authorization/organizations/{org_id}/resources getResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id} updateResourceByExternalId() | PATCH /authorization/organizations/{org_id}/resources/{type}/{external_id} deleteResourceByExternalId() | DELETE /authorization/organizations/{org_id}/resources/{type}/{external_id} ``` #1474 ``` listRoleAssignments() | GET /authorization/organization_memberships/{om_id}/role_assignments assignRole() | POST /authorization/organization_memberships/{om_id}/role_assignments removeRole() | DELETE /authorization/organization_memberships/{om_id}/role_assignments removeRoleAssignment() | DELETE /authorization/organization_memberships/{om_id}/role_assignments/{ra_id} ``` #1478 ``` listResourcesForMembership() | GET /authorization/organization_memberships/{om_id}/resources listMembershipsForResource() | GET /authorization/resources/{resource_id}/organization_memberships listMembershipsForResourceByExternalId() | GET /authorization/organizations/{org_id}/resources/{type}/{external_id}/organization_memberships ```

swaroopAkkineniWorkos added 19 commits February 9, 2026 09:08

Authorization Resources endpoints for Internal ID

310eeb1

lol

685643c

Merge branch 'main' into ENT-4372-Internal-ID

107fc6c

lol

ea2628e

lol

543b121

moar

c2734e8

lol

5037673

lol

ca6f2d1

lol

dfdd37d

lol

43a0765

pretty

b61be8a

moar

0b65b75

remove

9281d60

moar

24f6758

moar

ea41192

moar

6fb444c

moar

5689bee

Merge branch 'main' into ENT-4372-Internal-ID

1cb2d25

lol

f77627f

comments

1ddca39

swaroopAkkineniWorkos changed the title ~~lol~~ Authorization Resources (external ID) endpoints and listResources endpoint Feb 10, 2026

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

swaroopAkkineniWorkos and others added 6 commits February 10, 2026 11:39

moar

3e87446

moar

7364e46

moar

0dc5d30

lol

be4b7d3

lol

b38b24d

moar

fc934f0

Co-authored-by: Cursor <cursoragent@cursor.com>

lol

1d6124d

workos deleted a comment from greptile-apps bot Feb 10, 2026

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

workos deleted a comment from greptile-apps bot Feb 10, 2026

lol

64383ed

workos deleted a comment from greptile-apps bot Feb 10, 2026

greptile-apps bot reviewed Feb 10, 2026

View reviewed changes

src/authorization/serializers/list-authorization-resources-options.serializer.ts Outdated Show resolved Hide resolved

lol

bb2fb27

swaroopAkkineniWorkos marked this pull request as ready for review February 11, 2026 13:51

swaroopAkkineniWorkos requested a review from a team as a code owner February 11, 2026 13:51

swaroopAkkineniWorkos requested review from atainter, csrbarber, mattgd and nicknisi and removed request for a team February 11, 2026 13:51

greptile-apps bot reviewed Feb 11, 2026

View reviewed changes

csrbarber reviewed Feb 11, 2026

View reviewed changes

csrbarber approved these changes Feb 11, 2026

View reviewed changes

nicknisi reviewed Feb 11, 2026

View reviewed changes

nicknisi approved these changes Feb 11, 2026

View reviewed changes

Base automatically changed from ENT-4372-Internal-ID to ENT-4372-base-authorization-branch February 11, 2026 19:12

swaroopAkkineniWorkos mentioned this pull request Feb 11, 2026

Authorization Resources endpoints for Internal ID (#1471) #1479

Merged

atainter reviewed Feb 11, 2026

View reviewed changes

swaroopAkkineniWorkos added 2 commits February 11, 2026 10:07

merge conflicts

6389419

union of parentResourceExternalId & parentResourceTypeSlug (#1480)

53d03ba

swaroopAkkineniWorkos merged commit 4be4df5 into ENT-4372-base-authorization-branch Feb 12, 2026
8 checks passed

swaroopAkkineniWorkos deleted the ENT-4372-resources-external branch February 12, 2026 00:58

Conversation

swaroopAkkineniWorkos commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

linear bot commented Feb 10, 2026

Uh oh!

swaroopAkkineniWorkos commented Feb 10, 2026

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos commented Feb 10, 2026

Uh oh!

greptile-apps bot commented Feb 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Overview

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

greptile-apps bot left a comment

Choose a reason for hiding this comment

Uh oh!

csrbarber Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

nicknisi Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

swaroopAkkineniWorkos Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

atainter Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

4 participants

swaroopAkkineniWorkos commented Feb 10, 2026 •

edited

Loading

greptile-apps bot commented Feb 10, 2026 •

edited

Loading