diff --git a/.oagen-manifest.json b/.oagen-manifest.json
index 4da8af4f..3dd2b3da 100644
--- a/.oagen-manifest.json
+++ b/.oagen-manifest.json
@@ -1,7 +1,7 @@
 {
   "version": 2,
   "language": "ruby",
-  "generatedAt": "2026-04-27T20:55:49.741Z",
+  "generatedAt": "2026-04-30T17:41:02.756Z",
   "files": [
     "lib/workos.rb",
     "lib/workos/admin_portal.rb",
diff --git a/lib/workos/api_keys.rb b/lib/workos/api_keys.rb
index 746f4899..5fb3a995 100644
--- a/lib/workos/api_keys.rb
+++ b/lib/workos/api_keys.rb
@@ -20,7 +20,7 @@ def create_validation(
     )
       body = {
         "value" => value
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/api_keys/validations",
diff --git a/lib/workos/audit_logs.rb b/lib/workos/audit_logs.rb
index 7f21d0c7..45226db3 100644
--- a/lib/workos/audit_logs.rb
+++ b/lib/workos/audit_logs.rb
@@ -41,7 +41,7 @@ def update_organization_audit_logs_retention(
     )
       body = {
         "retention_period_in_days" => retention_period_in_days
-      }.compact
+      }
       response = @client.request(
         method: :put,
         path: "/organizations/#{WorkOS::Util.encode_path(id)}/audit_logs_retention",
@@ -189,7 +189,7 @@ def create_event(
       body = {
         "organization_id" => organization_id,
         "event" => event
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/audit_logs/events",
diff --git a/lib/workos/authorization.rb b/lib/workos/authorization.rb
index c651908c..fcdc09aa 100644
--- a/lib/workos/authorization.rb
+++ b/lib/workos/authorization.rb
@@ -6,6 +6,48 @@
 
 module WorkOS
   class Authorization
+    # Identifies the resource target (by id variant).
+    #
+    # @!attribute [r] resource_id
+    #   @return [String]
+    ResourceTargetById = Data.define(:resource_id)
+
+    # Identifies the resource target (by external id variant).
+    #
+    # @!attribute [r] resource_external_id
+    #   @return [String]
+    # @!attribute [r] resource_type_slug
+    #   @return [String]
+    ResourceTargetByExternalId = Data.define(:resource_external_id, :resource_type_slug)
+
+    # Identifies the parent resource (by id variant).
+    #
+    # @!attribute [r] parent_resource_id
+    #   @return [String]
+    ParentResourceById = Data.define(:parent_resource_id)
+
+    # Identifies the parent resource (by external id variant).
+    #
+    # @!attribute [r] parent_resource_type_slug
+    #   @return [String]
+    # @!attribute [r] parent_resource_external_id
+    #   @return [String]
+    ParentResourceByExternalId = Data.define(:parent_resource_type_slug, :parent_resource_external_id)
+
+    # Identifies the parent (by id variant).
+    #
+    # @!attribute [r] parent_resource_id
+    #   @return [String]
+    ParentById = Data.define(:parent_resource_id)
+
+    # Identifies the parent (by external id variant).
+    #
+    # @!attribute [r] parent_resource_type_slug
+    #   @return [String]
+    # @!attribute [r] parent_external_id
+    #   @return [String]
+    ParentByExternalId = Data.define(:parent_resource_type_slug, :parent_external_id)
+
     def initialize(client)
       @client = client
     end
@@ -13,32 +55,26 @@ def initialize(client)
     # Check authorization
     # @param organization_membership_id [String] The ID of the organization membership to check.
     # @param permission_slug [String] The slug of the permission to check.
-    # @param resource_id [String, nil] The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.
-    # @param resource_external_id [String, nil] The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`.
-    # @param resource_type_slug [String, nil] The slug of the resource type. Required with `resource_external_id`. Mutually exclusive with `resource_id`.
+    # @param resource_target [WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId] Identifies the resource target.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthorizationCheck]
     def check(
       organization_membership_id:,
       permission_slug:,
       resource_target:,
-      resource_id: nil,
-      resource_external_id: nil,
-      resource_type_slug: nil,
       request_options: {}
     )
       body = {
-        "permission_slug" => permission_slug,
-        "resource_id" => resource_id,
-        "resource_external_id" => resource_external_id,
-        "resource_type_slug" => resource_type_slug
-      }.compact
-      case resource_target[:type]
-      when "by_id"
-        body["resource_id"] = resource_target[:resource_id]
-      when "by_external_id"
-        body["resource_external_id"] = resource_target[:resource_external_id]
-        body["resource_type_slug"] = resource_target[:resource_type_slug]
+        "permission_slug" => permission_slug
+      }
+      case resource_target
+      when WorkOS::Authorization::ResourceTargetById
+        body["resource_id"] = resource_target.resource_id
+      when WorkOS::Authorization::ResourceTargetByExternalId
+        body["resource_external_id"] = resource_target.resource_external_id
+        body["resource_type_slug"] = resource_target.resource_type_slug
+      else
+        raise ArgumentError, "expected resource_target to be one of: WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId, got #{resource_target.class}"
       end
       response = @client.request(
         method: :post,
@@ -59,6 +95,7 @@ def check(
     # @param limit [Integer, nil] Upper limit on the number of objects to return, between `1` and `100`.
     # @param order [WorkOS::Types::AuthorizationOrder, nil] Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to descending.
     # @param permission_slug [String] The permission slug to filter by. Only child resources where the organization membership has this permission are returned.
+    # @param parent_resource [WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId] Identifies the parent resource.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::AuthorizationResource>]
     def list_resources_for_membership(
@@ -78,12 +115,14 @@ def list_resources_for_membership(
         "order" => order,
         "permission_slug" => permission_slug
       }.compact
-      case parent_resource[:type]
-      when "by_id"
-        params["parent_resource_id"] = parent_resource[:parent_resource_id]
-      when "by_external_id"
-        params["parent_resource_type_slug"] = parent_resource[:parent_resource_type_slug]
-        params["parent_resource_external_id"] = parent_resource[:parent_resource_external_id]
+      case parent_resource
+      when WorkOS::Authorization::ParentResourceById
+        params["parent_resource_id"] = parent_resource.parent_resource_id
+      when WorkOS::Authorization::ParentResourceByExternalId
+        params["parent_resource_type_slug"] = parent_resource.parent_resource_type_slug
+        params["parent_resource_external_id"] = parent_resource.parent_resource_external_id
+      else
+        raise ArgumentError, "expected parent_resource to be one of: WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, got #{parent_resource.class}"
       end
       response = @client.request(
         method: :get,
@@ -265,32 +304,26 @@ def list_role_assignments(
     # Assign a role
     # @param organization_membership_id [String] The ID of the organization membership.
     # @param role_slug [String] The slug of the role to assign.
-    # @param resource_id [String, nil] The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.
-    # @param resource_external_id [String, nil] The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`.
-    # @param resource_type_slug [String, nil] The resource type slug. Required with `resource_external_id`. Mutually exclusive with `resource_id`.
+    # @param resource_target [WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId] Identifies the resource target.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::RoleAssignment]
     def assign_role(
       organization_membership_id:,
       role_slug:,
       resource_target:,
-      resource_id: nil,
-      resource_external_id: nil,
-      resource_type_slug: nil,
       request_options: {}
     )
       body = {
-        "role_slug" => role_slug,
-        "resource_id" => resource_id,
-        "resource_external_id" => resource_external_id,
-        "resource_type_slug" => resource_type_slug
-      }.compact
-      case resource_target[:type]
-      when "by_id"
-        body["resource_id"] = resource_target[:resource_id]
-      when "by_external_id"
-        body["resource_external_id"] = resource_target[:resource_external_id]
-        body["resource_type_slug"] = resource_target[:resource_type_slug]
+        "role_slug" => role_slug
+      }
+      case resource_target
+      when WorkOS::Authorization::ResourceTargetById
+        body["resource_id"] = resource_target.resource_id
+      when WorkOS::Authorization::ResourceTargetByExternalId
+        body["resource_external_id"] = resource_target.resource_external_id
+        body["resource_type_slug"] = resource_target.resource_type_slug
+      else
+        raise ArgumentError, "expected resource_target to be one of: WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId, got #{resource_target.class}"
       end
       response = @client.request(
         method: :post,
@@ -307,34 +340,28 @@ def assign_role(
     # Remove a role assignment
     # @param organization_membership_id [String] The ID of the organization membership.
     # @param role_slug [String] The slug of the role to remove.
-    # @param resource_id [String, nil] The ID of the resource. Mutually exclusive with `resource_external_id` and `resource_type_slug`.
-    # @param resource_external_id [String, nil] The external ID of the resource. Required with `resource_type_slug`. Mutually exclusive with `resource_id`.
-    # @param resource_type_slug [String, nil] The resource type slug. Required with `resource_external_id`. Mutually exclusive with `resource_id`.
+    # @param resource_target [WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId] Identifies the resource target.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [void]
     def remove_role(
       organization_membership_id:,
       role_slug:,
       resource_target:,
-      resource_id: nil,
-      resource_external_id: nil,
-      resource_type_slug: nil,
       request_options: {}
     )
-      params = {}.compact
-      case resource_target[:type]
-      when "by_id"
-        params["resource_id"] = resource_target[:resource_id]
-      when "by_external_id"
-        params["resource_external_id"] = resource_target[:resource_external_id]
-        params["resource_type_slug"] = resource_target[:resource_type_slug]
+      params = {}
+      case resource_target
+      when WorkOS::Authorization::ResourceTargetById
+        params["resource_id"] = resource_target.resource_id
+      when WorkOS::Authorization::ResourceTargetByExternalId
+        params["resource_external_id"] = resource_target.resource_external_id
+        params["resource_type_slug"] = resource_target.resource_type_slug
+      else
+        raise ArgumentError, "expected resource_target to be one of: WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId, got #{resource_target.class}"
       end
       body = {
-        "role_slug" => role_slug,
-        "resource_id" => resource_id,
-        "resource_external_id" => resource_external_id,
-        "resource_type_slug" => resource_type_slug
-      }.compact
+        "role_slug" => role_slug
+      }
       @client.request(
         method: :delete,
         path: "/authorization/organization_memberships/#{WorkOS::Util.encode_path(organization_membership_id)}/role_assignments",
@@ -502,7 +529,7 @@ def add_organization_role_permission(
     )
       body = {
         "slug" => body_slug
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/authorization/organizations/#{WorkOS::Util.encode_path(organization_id)}/roles/#{WorkOS::Util.encode_path(slug)}/permissions",
@@ -529,7 +556,7 @@ def set_organization_role_permissions(
     )
       body = {
         "permissions" => permissions
-      }.compact
+      }
       response = @client.request(
         method: :put,
         path: "/authorization/organizations/#{WorkOS::Util.encode_path(organization_id)}/roles/#{WorkOS::Util.encode_path(slug)}/permissions",
@@ -594,9 +621,7 @@ def get_resource_by_external_id(
     # @param external_id [String] An identifier you provide to reference the resource in your system.
     # @param name [String, nil] A display name for the resource.
     # @param description [String, nil] An optional description of the resource.
-    # @param parent_resource_id [String, nil] The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`.
-    # @param parent_resource_external_id [String, nil] The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.
-    # @param parent_resource_type_slug [String, nil] The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`.
+    # @param parent_resource [WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, nil] Identifies the parent resource.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthorizationResource]
     def update_resource_by_external_id(
@@ -605,26 +630,22 @@ def update_resource_by_external_id(
       external_id:,
       name: nil,
       description: nil,
-      parent_resource_id: nil,
-      parent_resource_external_id: nil,
-      parent_resource_type_slug: nil,
       parent_resource: nil,
       request_options: {}
     )
       body = {
         "name" => name,
-        "description" => description,
-        "parent_resource_id" => parent_resource_id,
-        "parent_resource_external_id" => parent_resource_external_id,
-        "parent_resource_type_slug" => parent_resource_type_slug
+        "description" => description
       }.compact
       if parent_resource
-        case parent_resource[:type]
-        when "by_id"
-          body["parent_resource_id"] = parent_resource[:parent_resource_id]
-        when "by_external_id"
-          body["parent_resource_external_id"] = parent_resource[:parent_resource_external_id]
-          body["parent_resource_type_slug"] = parent_resource[:parent_resource_type_slug]
+        case parent_resource
+        when WorkOS::Authorization::ParentResourceById
+          body["parent_resource_id"] = parent_resource.parent_resource_id
+        when WorkOS::Authorization::ParentResourceByExternalId
+          body["parent_resource_external_id"] = parent_resource.parent_resource_external_id
+          body["parent_resource_type_slug"] = parent_resource.parent_resource_type_slug
+        else
+          raise ArgumentError, "expected parent_resource to be one of: WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, got #{parent_resource.class}"
         end
       end
       response = @client.request(
@@ -736,6 +757,7 @@ def list_memberships_for_resource_by_external_id(
     # @param resource_type_slug [String, nil] Filter resources by resource type slug.
     # @param resource_external_id [String, nil] Filter resources by external ID.
     # @param search [String, nil] Search resources by name.
+    # @param parent [WorkOS::Authorization::ParentById, WorkOS::Authorization::ParentByExternalId, nil] Identifies the parent.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::Types::ListStruct<WorkOS::AuthorizationResource>]
     def list_resources(
@@ -761,12 +783,14 @@ def list_resources(
         "search" => search
       }.compact
       if parent
-        case parent[:type]
-        when "by_id"
-          params["parent_resource_id"] = parent[:parent_resource_id]
-        when "by_external_id"
-          params["parent_resource_type_slug"] = parent[:parent_resource_type_slug]
-          params["parent_external_id"] = parent[:parent_external_id]
+        case parent
+        when WorkOS::Authorization::ParentById
+          params["parent_resource_id"] = parent.parent_resource_id
+        when WorkOS::Authorization::ParentByExternalId
+          params["parent_resource_type_slug"] = parent.parent_resource_type_slug
+          params["parent_external_id"] = parent.parent_external_id
+        else
+          raise ArgumentError, "expected parent to be one of: WorkOS::Authorization::ParentById, WorkOS::Authorization::ParentByExternalId, got #{parent.class}"
         end
       end
       response = @client.request(
@@ -804,9 +828,7 @@ def list_resources(
     # @param description [String, nil] An optional description of the resource.
     # @param resource_type_slug [String] The slug of the resource type.
     # @param organization_id [String] The ID of the organization this resource belongs to.
-    # @param parent_resource_id [String, nil] The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`.
-    # @param parent_resource_external_id [String, nil] The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.
-    # @param parent_resource_type_slug [String, nil] The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`.
+    # @param parent_resource [WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, nil] Identifies the parent resource.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthorizationResource]
     def create_resource(
@@ -815,9 +837,6 @@ def create_resource(
       resource_type_slug:,
       organization_id:,
       description: nil,
-      parent_resource_id: nil,
-      parent_resource_external_id: nil,
-      parent_resource_type_slug: nil,
       parent_resource: nil,
       request_options: {}
     )
@@ -826,18 +845,17 @@ def create_resource(
         "name" => name,
         "description" => description,
         "resource_type_slug" => resource_type_slug,
-        "organization_id" => organization_id,
-        "parent_resource_id" => parent_resource_id,
-        "parent_resource_external_id" => parent_resource_external_id,
-        "parent_resource_type_slug" => parent_resource_type_slug
+        "organization_id" => organization_id
       }.compact
       if parent_resource
-        case parent_resource[:type]
-        when "by_id"
-          body["parent_resource_id"] = parent_resource[:parent_resource_id]
-        when "by_external_id"
-          body["parent_resource_external_id"] = parent_resource[:parent_resource_external_id]
-          body["parent_resource_type_slug"] = parent_resource[:parent_resource_type_slug]
+        case parent_resource
+        when WorkOS::Authorization::ParentResourceById
+          body["parent_resource_id"] = parent_resource.parent_resource_id
+        when WorkOS::Authorization::ParentResourceByExternalId
+          body["parent_resource_external_id"] = parent_resource.parent_resource_external_id
+          body["parent_resource_type_slug"] = parent_resource.parent_resource_type_slug
+        else
+          raise ArgumentError, "expected parent_resource to be one of: WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, got #{parent_resource.class}"
         end
       end
       response = @client.request(
@@ -875,35 +893,29 @@ def get_resource(
     # @param resource_id [String] The ID of the authorization resource.
     # @param name [String, nil] A display name for the resource.
     # @param description [String, nil] An optional description of the resource.
-    # @param parent_resource_id [String, nil] The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`.
-    # @param parent_resource_external_id [String, nil] The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`.
-    # @param parent_resource_type_slug [String, nil] The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`.
+    # @param parent_resource [WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, nil] Identifies the parent resource.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::AuthorizationResource]
     def update_resource(
       resource_id:,
       name: nil,
       description: nil,
-      parent_resource_id: nil,
-      parent_resource_external_id: nil,
-      parent_resource_type_slug: nil,
       parent_resource: nil,
       request_options: {}
     )
       body = {
         "name" => name,
-        "description" => description,
-        "parent_resource_id" => parent_resource_id,
-        "parent_resource_external_id" => parent_resource_external_id,
-        "parent_resource_type_slug" => parent_resource_type_slug
+        "description" => description
       }.compact
       if parent_resource
-        case parent_resource[:type]
-        when "by_id"
-          body["parent_resource_id"] = parent_resource[:parent_resource_id]
-        when "by_external_id"
-          body["parent_resource_external_id"] = parent_resource[:parent_resource_external_id]
-          body["parent_resource_type_slug"] = parent_resource[:parent_resource_type_slug]
+        case parent_resource
+        when WorkOS::Authorization::ParentResourceById
+          body["parent_resource_id"] = parent_resource.parent_resource_id
+        when WorkOS::Authorization::ParentResourceByExternalId
+          body["parent_resource_external_id"] = parent_resource.parent_resource_external_id
+          body["parent_resource_type_slug"] = parent_resource.parent_resource_type_slug
+        else
+          raise ArgumentError, "expected parent_resource to be one of: WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId, got #{parent_resource.class}"
         end
       end
       response = @client.request(
@@ -1102,7 +1114,7 @@ def add_environment_role_permission(
     )
       body = {
         "slug" => body_slug
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/authorization/roles/#{WorkOS::Util.encode_path(slug)}/permissions",
@@ -1127,7 +1139,7 @@ def set_environment_role_permissions(
     )
       body = {
         "permissions" => permissions
-      }.compact
+      }
       response = @client.request(
         method: :put,
         path: "/authorization/roles/#{WorkOS::Util.encode_path(slug)}/permissions",
diff --git a/lib/workos/groups.rb b/lib/workos/groups.rb
index 75d7ddb2..d506e1f9 100644
--- a/lib/workos/groups.rb
+++ b/lib/workos/groups.rb
@@ -219,7 +219,7 @@ def create_group_organization_membership(
     )
       body = {
         "organization_membership_id" => organization_membership_id
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/organizations/#{WorkOS::Util.encode_path(organization_id)}/groups/#{WorkOS::Util.encode_path(group_id)}/organization-memberships",
diff --git a/lib/workos/multi_factor_auth.rb b/lib/workos/multi_factor_auth.rb
index 93f2f6ea..59b66850 100644
--- a/lib/workos/multi_factor_auth.rb
+++ b/lib/workos/multi_factor_auth.rb
@@ -22,7 +22,7 @@ def verify_challenge(
     )
       body = {
         "code" => code
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/auth/challenges/#{WorkOS::Util.encode_path(id)}/verify",
diff --git a/lib/workos/organization_domains.rb b/lib/workos/organization_domains.rb
index 05f5861f..c0b9970d 100644
--- a/lib/workos/organization_domains.rb
+++ b/lib/workos/organization_domains.rb
@@ -23,7 +23,7 @@ def create_organization_domain(
       body = {
         "domain" => domain,
         "organization_id" => organization_id
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/organization_domains",
diff --git a/lib/workos/radar.rb b/lib/workos/radar.rb
index 6d0da00a..451f817f 100644
--- a/lib/workos/radar.rb
+++ b/lib/workos/radar.rb
@@ -91,7 +91,7 @@ def add_list_entry(
     )
       body = {
         "entry" => entry
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/radar/lists/#{WorkOS::Util.encode_path(type)}/#{WorkOS::Util.encode_path(action)}",
@@ -118,7 +118,7 @@ def remove_list_entry(
     )
       body = {
         "entry" => entry
-      }.compact
+      }
       @client.request(
         method: :delete,
         path: "/radar/lists/#{WorkOS::Util.encode_path(type)}/#{WorkOS::Util.encode_path(action)}",
diff --git a/lib/workos/sso.rb b/lib/workos/sso.rb
index 9585b943..6f71c5ed 100644
--- a/lib/workos/sso.rb
+++ b/lib/workos/sso.rb
@@ -116,7 +116,7 @@ def authorize_logout(
     )
       body = {
         "profile_id" => profile_id
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/sso/logout/authorize",
@@ -157,7 +157,7 @@ def get_profile_and_token(
         "client_id" => request_options[:client_id] || @client.client_id,
         "client_secret" => request_options[:api_key] || @client.api_key,
         "code" => code
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/sso/token",
diff --git a/lib/workos/user_management.rb b/lib/workos/user_management.rb
index d1dd282e..b76145fa 100644
--- a/lib/workos/user_management.rb
+++ b/lib/workos/user_management.rb
@@ -6,6 +6,32 @@
 
 module WorkOS
   class UserManagement
+    # Identifies the password (plaintext variant).
+    #
+    # @!attribute [r] password
+    #   @return [String]
+    PasswordPlaintext = Data.define(:password)
+
+    # Identifies the password (hashed variant).
+    #
+    # @!attribute [r] password_hash
+    #   @return [String]
+    # @!attribute [r] password_hash_type
+    #   @return [WorkOS::Types::CreateUserPasswordHashType]
+    PasswordHashed = Data.define(:password_hash, :password_hash_type)
+
+    # Identifies the role (single variant).
+    #
+    # @!attribute [r] role_slug
+    #   @return [String]
+    RoleSingle = Data.define(:role_slug)
+
+    # Identifies the role (multiple variant).
+    #
+    # @!attribute [r] role_slugs
+    #   @return [Array<String>]
+    RoleMultiple = Data.define(:role_slugs)
+
     def initialize(client)
       @client = client
     end
@@ -403,7 +429,7 @@ def create_device(
     )
       body = {
         "client_id" => client_id
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/authorize/device",
@@ -450,7 +476,7 @@ def create_cors_origin(
     )
       body = {
         "origin" => origin
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/cors_origins",
@@ -492,7 +518,7 @@ def reset_password(
     )
       body = {
         "email" => email
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/password_reset",
@@ -518,7 +544,7 @@ def confirm_password_reset(
       body = {
         "token" => token,
         "new_password" => new_password
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/password_reset/confirm",
@@ -613,9 +639,7 @@ def list_users(
     # @param email_verified [Boolean, nil] Whether the user's email has been verified.
     # @param metadata [Hash{String => String}, nil] Object containing metadata key/value pairs associated with the user.
     # @param external_id [String, nil] The external ID of the user.
-    # @param password [String, nil] The password to set for the user. Mutually exclusive with `password_hash` and `password_hash_type`.
-    # @param password_hash [String, nil] The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`.
-    # @param password_hash_type [WorkOS::Types::CreateUserPasswordHashType, nil] The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`.
+    # @param password [WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, nil] Identifies the password.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::User]
     def create_user(
@@ -626,8 +650,6 @@ def create_user(
       metadata: nil,
       external_id: nil,
       password: nil,
-      password_hash: nil,
-      password_hash_type: nil,
       request_options: {}
     )
       body = {
@@ -636,18 +658,17 @@ def create_user(
         "last_name" => last_name,
         "email_verified" => email_verified,
         "metadata" => metadata,
-        "external_id" => external_id,
-        "password" => password,
-        "password_hash" => password_hash,
-        "password_hash_type" => password_hash_type
+        "external_id" => external_id
       }.compact
       if password
-        case password[:type]
-        when "plaintext"
-          body["password"] = password[:password]
-        when "hashed"
-          body["password_hash"] = password[:password_hash]
-          body["password_hash_type"] = password[:password_hash_type]
+        case password
+        when WorkOS::UserManagement::PasswordPlaintext
+          body["password"] = password.password
+        when WorkOS::UserManagement::PasswordHashed
+          body["password_hash"] = password.password_hash
+          body["password_hash_type"] = password.password_hash_type
+        else
+          raise ArgumentError, "expected password to be one of: WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, got #{password.class}"
         end
       end
       response = @client.request(
@@ -709,9 +730,7 @@ def get_user(
     # @param metadata [Hash{String => String}, nil] Object containing metadata key/value pairs associated with the user.
     # @param external_id [String, nil] The external ID of the user.
     # @param locale [String, nil] The user's preferred locale.
-    # @param password [String, nil] The password to set for the user. Mutually exclusive with `password_hash` and `password_hash_type`.
-    # @param password_hash [String, nil] The hashed password to set for the user. Required with `password_hash_type`. Mutually exclusive with `password`.
-    # @param password_hash_type [WorkOS::Types::UpdateUserPasswordHashType, nil] The algorithm originally used to hash the password, used when providing a `password_hash`. Required with `password_hash`. Mutually exclusive with `password`.
+    # @param password [WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, nil] Identifies the password.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::User]
     def update_user(
@@ -724,8 +743,6 @@ def update_user(
       external_id: nil,
       locale: nil,
       password: nil,
-      password_hash: nil,
-      password_hash_type: nil,
       request_options: {}
     )
       body = {
@@ -735,18 +752,17 @@ def update_user(
         "email_verified" => email_verified,
         "metadata" => metadata,
         "external_id" => external_id,
-        "locale" => locale,
-        "password" => password,
-        "password_hash" => password_hash,
-        "password_hash_type" => password_hash_type
+        "locale" => locale
       }.compact
       if password
-        case password[:type]
-        when "plaintext"
-          body["password"] = password[:password]
-        when "hashed"
-          body["password_hash"] = password[:password_hash]
-          body["password_hash_type"] = password[:password_hash_type]
+        case password
+        when WorkOS::UserManagement::PasswordPlaintext
+          body["password"] = password.password
+        when WorkOS::UserManagement::PasswordHashed
+          body["password_hash"] = password.password_hash
+          body["password_hash_type"] = password.password_hash_type
+        else
+          raise ArgumentError, "expected password to be one of: WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed, got #{password.class}"
         end
       end
       response = @client.request(
@@ -790,7 +806,7 @@ def confirm_email_change(
     )
       body = {
         "code" => code
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/users/#{WorkOS::Util.encode_path(id)}/email_change/confirm",
@@ -815,7 +831,7 @@ def send_email_change(
     )
       body = {
         "new_email" => new_email
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/users/#{WorkOS::Util.encode_path(id)}/email_change/send",
@@ -840,7 +856,7 @@ def verify_email(
     )
       body = {
         "code" => code
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/users/#{WorkOS::Util.encode_path(id)}/email_verification/confirm",
@@ -1138,7 +1154,7 @@ def update_jwt_template(
     )
       body = {
         "content" => content
-      }.compact
+      }
       response = @client.request(
         method: :put,
         path: "/user_management/jwt_template",
@@ -1255,30 +1271,27 @@ def list_organization_memberships(
     # Create an organization membership
     # @param user_id [String] The ID of the [user](https://workos.com/docs/reference/authkit/user).
     # @param organization_id [String] The ID of the [organization](https://workos.com/docs/reference/organization) which the user belongs to.
-    # @param role_slug [String, nil] A single role identifier. Defaults to `member` or the explicit default role. Mutually exclusive with `role_slugs`.
-    # @param role_slugs [Array<String>, nil] An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`.
+    # @param role [WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, nil] Identifies the role.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::OrganizationMembership]
     def create_organization_membership(
       user_id:,
       organization_id:,
-      role_slug: nil,
-      role_slugs: nil,
       role: nil,
       request_options: {}
     )
       body = {
         "user_id" => user_id,
-        "organization_id" => organization_id,
-        "role_slug" => role_slug,
-        "role_slugs" => role_slugs
-      }.compact
+        "organization_id" => organization_id
+      }
       if role
-        case role[:type]
-        when "single"
-          body["role_slug"] = role[:role_slug]
-        when "multiple"
-          body["role_slugs"] = role[:role_slugs]
+        case role
+        when WorkOS::UserManagement::RoleSingle
+          body["role_slug"] = role.role_slug
+        when WorkOS::UserManagement::RoleMultiple
+          body["role_slugs"] = role.role_slugs
+        else
+          raise ArgumentError, "expected role to be one of: WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, got #{role.class}"
         end
       end
       response = @client.request(
@@ -1314,27 +1327,23 @@ def get_organization_membership(
 
     # Update an organization membership
     # @param id [String] The unique ID of the organization membership.
-    # @param role_slug [String, nil] A single role identifier. Defaults to `member` or the explicit default role. Mutually exclusive with `role_slugs`.
-    # @param role_slugs [Array<String>, nil] An array of role identifiers. Limited to one role when Multiple Roles is disabled. Mutually exclusive with `role_slug`.
+    # @param role [WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, nil] Identifies the role.
     # @param request_options [Hash] (see WorkOS::Types::RequestOptions)
     # @return [WorkOS::UserOrganizationMembership]
     def update_organization_membership(
       id:,
-      role_slug: nil,
-      role_slugs: nil,
       role: nil,
       request_options: {}
     )
-      body = {
-        "role_slug" => role_slug,
-        "role_slugs" => role_slugs
-      }.compact
+      body = {}
       if role
-        case role[:type]
-        when "single"
-          body["role_slug"] = role[:role_slug]
-        when "multiple"
-          body["role_slugs"] = role[:role_slugs]
+        case role
+        when WorkOS::UserManagement::RoleSingle
+          body["role_slug"] = role.role_slug
+        when WorkOS::UserManagement::RoleMultiple
+          body["role_slugs"] = role.role_slugs
+        else
+          raise ArgumentError, "expected role to be one of: WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple, got #{role.class}"
         end
       end
       response = @client.request(
@@ -1414,7 +1423,7 @@ def create_redirect_uri(
     )
       body = {
         "uri" => uri
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/user_management/redirect_uris",
diff --git a/lib/workos/webhooks.rb b/lib/workos/webhooks.rb
index d2303d53..8b86d12c 100644
--- a/lib/workos/webhooks.rb
+++ b/lib/workos/webhooks.rb
@@ -67,7 +67,7 @@ def create_webhook_endpoint(
       body = {
         "endpoint_url" => endpoint_url,
         "events" => events
-      }.compact
+      }
       response = @client.request(
         method: :post,
         path: "/webhook_endpoints",
diff --git a/rbi/workos/authorization.rbi b/rbi/workos/authorization.rbi
index 3089a0ef..5e4eea64 100644
--- a/rbi/workos/authorization.rbi
+++ b/rbi/workos/authorization.rbi
@@ -6,6 +6,90 @@
 
 module WorkOS
   class Authorization
+    class ResourceTargetById
+      sig { returns(String) }
+      def resource_id; end
+
+      sig do
+        params(
+          resource_id: String
+        ).returns(WorkOS::Authorization::ResourceTargetById)
+      end
+      def self.new(resource_id:); end
+    end
+
+    class ResourceTargetByExternalId
+      sig { returns(String) }
+      def resource_external_id; end
+
+      sig { returns(String) }
+      def resource_type_slug; end
+
+      sig do
+        params(
+          resource_external_id: String,
+          resource_type_slug: String
+        ).returns(WorkOS::Authorization::ResourceTargetByExternalId)
+      end
+      def self.new(resource_external_id:, resource_type_slug:); end
+    end
+
+    class ParentResourceById
+      sig { returns(String) }
+      def parent_resource_id; end
+
+      sig do
+        params(
+          parent_resource_id: String
+        ).returns(WorkOS::Authorization::ParentResourceById)
+      end
+      def self.new(parent_resource_id:); end
+    end
+
+    class ParentResourceByExternalId
+      sig { returns(String) }
+      def parent_resource_type_slug; end
+
+      sig { returns(String) }
+      def parent_resource_external_id; end
+
+      sig do
+        params(
+          parent_resource_type_slug: String,
+          parent_resource_external_id: String
+        ).returns(WorkOS::Authorization::ParentResourceByExternalId)
+      end
+      def self.new(parent_resource_type_slug:, parent_resource_external_id:); end
+    end
+
+    class ParentById
+      sig { returns(String) }
+      def parent_resource_id; end
+
+      sig do
+        params(
+          parent_resource_id: String
+        ).returns(WorkOS::Authorization::ParentById)
+      end
+      def self.new(parent_resource_id:); end
+    end
+
+    class ParentByExternalId
+      sig { returns(String) }
+      def parent_resource_type_slug; end
+
+      sig { returns(String) }
+      def parent_external_id; end
+
+      sig do
+        params(
+          parent_resource_type_slug: String,
+          parent_external_id: String
+        ).returns(WorkOS::Authorization::ParentByExternalId)
+      end
+      def self.new(parent_resource_type_slug:, parent_external_id:); end
+    end
+
     sig { params(client: WorkOS::BaseClient).void }
     def initialize(client); end
 
@@ -13,18 +97,17 @@ module WorkOS
       params(
         organization_membership_id: String,
         permission_slug: String,
-        resource_id: T.nilable(String),
-        resource_external_id: T.nilable(String),
-        resource_type_slug: T.nilable(String),
+        resource_target: T.any(WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::AuthorizationCheck)
     end
-    def check(organization_membership_id:, permission_slug:, resource_id:, resource_external_id:, resource_type_slug:, request_options:); end
+    def check(organization_membership_id:, permission_slug:, resource_target:, request_options:); end
 
     sig do
       params(
         organization_membership_id: String,
         permission_slug: String,
+        parent_resource: T.any(WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId),
         before: T.nilable(String),
         after: T.nilable(String),
         limit: T.nilable(Integer),
@@ -32,7 +115,7 @@ module WorkOS
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::Types::ListStruct)
     end
-    def list_resources_for_membership(organization_membership_id:, permission_slug:, before:, after:, limit:, order:, request_options:); end
+    def list_resources_for_membership(organization_membership_id:, permission_slug:, parent_resource:, before:, after:, limit:, order:, request_options:); end
 
     sig do
       params(
@@ -77,25 +160,21 @@ module WorkOS
       params(
         organization_membership_id: String,
         role_slug: String,
-        resource_id: T.nilable(String),
-        resource_external_id: T.nilable(String),
-        resource_type_slug: T.nilable(String),
+        resource_target: T.any(WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::RoleAssignment)
     end
-    def assign_role(organization_membership_id:, role_slug:, resource_id:, resource_external_id:, resource_type_slug:, request_options:); end
+    def assign_role(organization_membership_id:, role_slug:, resource_target:, request_options:); end
 
     sig do
       params(
         organization_membership_id: String,
         role_slug: String,
-        resource_id: T.nilable(String),
-        resource_external_id: T.nilable(String),
-        resource_type_slug: T.nilable(String),
+        resource_target: T.any(WorkOS::Authorization::ResourceTargetById, WorkOS::Authorization::ResourceTargetByExternalId),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(NilClass)
     end
-    def remove_role(organization_membership_id:, role_slug:, resource_id:, resource_external_id:, resource_type_slug:, request_options:); end
+    def remove_role(organization_membership_id:, role_slug:, resource_target:, request_options:); end
 
     sig do
       params(
@@ -201,13 +280,11 @@ module WorkOS
         external_id: String,
         name: T.nilable(String),
         description: T.nilable(String),
-        parent_resource_id: T.nilable(String),
-        parent_resource_external_id: T.nilable(String),
-        parent_resource_type_slug: T.nilable(String),
+        parent_resource: T.nilable(T.any(WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::AuthorizationResource)
     end
-    def update_resource_by_external_id(organization_id:, resource_type_slug:, external_id:, name:, description:, parent_resource_id:, parent_resource_external_id:, parent_resource_type_slug:, request_options:); end
+    def update_resource_by_external_id(organization_id:, resource_type_slug:, external_id:, name:, description:, parent_resource:, request_options:); end
 
     sig do
       params(
@@ -246,10 +323,11 @@ module WorkOS
         resource_type_slug: T.nilable(String),
         resource_external_id: T.nilable(String),
         search: T.nilable(String),
+        parent: T.nilable(T.any(WorkOS::Authorization::ParentById, WorkOS::Authorization::ParentByExternalId)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::Types::ListStruct)
     end
-    def list_resources(before:, after:, limit:, order:, organization_id:, resource_type_slug:, resource_external_id:, search:, request_options:); end
+    def list_resources(before:, after:, limit:, order:, organization_id:, resource_type_slug:, resource_external_id:, search:, parent:, request_options:); end
 
     sig do
       params(
@@ -258,13 +336,11 @@ module WorkOS
         resource_type_slug: String,
         organization_id: String,
         description: T.nilable(String),
-        parent_resource_id: T.nilable(String),
-        parent_resource_external_id: T.nilable(String),
-        parent_resource_type_slug: T.nilable(String),
+        parent_resource: T.nilable(T.any(WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::AuthorizationResource)
     end
-    def create_resource(external_id:, name:, resource_type_slug:, organization_id:, description:, parent_resource_id:, parent_resource_external_id:, parent_resource_type_slug:, request_options:); end
+    def create_resource(external_id:, name:, resource_type_slug:, organization_id:, description:, parent_resource:, request_options:); end
 
     sig do
       params(
@@ -279,13 +355,11 @@ module WorkOS
         resource_id: String,
         name: T.nilable(String),
         description: T.nilable(String),
-        parent_resource_id: T.nilable(String),
-        parent_resource_external_id: T.nilable(String),
-        parent_resource_type_slug: T.nilable(String),
+        parent_resource: T.nilable(T.any(WorkOS::Authorization::ParentResourceById, WorkOS::Authorization::ParentResourceByExternalId)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::AuthorizationResource)
     end
-    def update_resource(resource_id:, name:, description:, parent_resource_id:, parent_resource_external_id:, parent_resource_type_slug:, request_options:); end
+    def update_resource(resource_id:, name:, description:, parent_resource:, request_options:); end
 
     sig do
       params(
diff --git a/rbi/workos/user_management.rbi b/rbi/workos/user_management.rbi
index 53d746e7..2d2c0bca 100644
--- a/rbi/workos/user_management.rbi
+++ b/rbi/workos/user_management.rbi
@@ -6,6 +6,58 @@
 
 module WorkOS
   class UserManagement
+    class PasswordPlaintext
+      sig { returns(String) }
+      def password; end
+
+      sig do
+        params(
+          password: String
+        ).returns(WorkOS::UserManagement::PasswordPlaintext)
+      end
+      def self.new(password:); end
+    end
+
+    class PasswordHashed
+      sig { returns(String) }
+      def password_hash; end
+
+      sig { returns(String) }
+      def password_hash_type; end
+
+      sig do
+        params(
+          password_hash: String,
+          password_hash_type: String
+        ).returns(WorkOS::UserManagement::PasswordHashed)
+      end
+      def self.new(password_hash:, password_hash_type:); end
+    end
+
+    class RoleSingle
+      sig { returns(String) }
+      def role_slug; end
+
+      sig do
+        params(
+          role_slug: String
+        ).returns(WorkOS::UserManagement::RoleSingle)
+      end
+      def self.new(role_slug:); end
+    end
+
+    class RoleMultiple
+      sig { returns(T::Array[String]) }
+      def role_slugs; end
+
+      sig do
+        params(
+          role_slugs: T::Array[String]
+        ).returns(WorkOS::UserManagement::RoleMultiple)
+      end
+      def self.new(role_slugs:); end
+    end
+
     sig { params(client: WorkOS::BaseClient).void }
     def initialize(client); end
 
@@ -113,13 +165,11 @@ module WorkOS
         email_verified: T.nilable(T::Boolean),
         metadata: T.nilable(T::Hash[String, String]),
         external_id: T.nilable(String),
-        password: T.nilable(String),
-        password_hash: T.nilable(String),
-        password_hash_type: T.nilable(String),
+        password: T.nilable(T.any(WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::User)
     end
-    def create_user(email:, first_name:, last_name:, email_verified:, metadata:, external_id:, password:, password_hash:, password_hash_type:, request_options:); end
+    def create_user(email:, first_name:, last_name:, email_verified:, metadata:, external_id:, password:, request_options:); end
 
     sig do
       params(
@@ -147,13 +197,11 @@ module WorkOS
         metadata: T.nilable(T::Hash[String, String]),
         external_id: T.nilable(String),
         locale: T.nilable(String),
-        password: T.nilable(String),
-        password_hash: T.nilable(String),
-        password_hash_type: T.nilable(String),
+        password: T.nilable(T.any(WorkOS::UserManagement::PasswordPlaintext, WorkOS::UserManagement::PasswordHashed)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::User)
     end
-    def update_user(id:, email:, first_name:, last_name:, email_verified:, metadata:, external_id:, locale:, password:, password_hash:, password_hash_type:, request_options:); end
+    def update_user(id:, email:, first_name:, last_name:, email_verified:, metadata:, external_id:, locale:, password:, request_options:); end
 
     sig do
       params(
@@ -328,12 +376,11 @@ module WorkOS
       params(
         user_id: String,
         organization_id: String,
-        role_slug: T.nilable(String),
-        role_slugs: T.nilable(T::Array[String]),
+        role: T.nilable(T.any(WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::OrganizationMembership)
     end
-    def create_organization_membership(user_id:, organization_id:, role_slug:, role_slugs:, request_options:); end
+    def create_organization_membership(user_id:, organization_id:, role:, request_options:); end
 
     sig do
       params(
@@ -346,12 +393,11 @@ module WorkOS
     sig do
       params(
         id: String,
-        role_slug: T.nilable(String),
-        role_slugs: T.nilable(T::Array[String]),
+        role: T.nilable(T.any(WorkOS::UserManagement::RoleSingle, WorkOS::UserManagement::RoleMultiple)),
         request_options: T::Hash[Symbol, T.untyped]
       ).returns(WorkOS::UserOrganizationMembership)
     end
-    def update_organization_membership(id:, role_slug:, role_slugs:, request_options:); end
+    def update_organization_membership(id:, role:, request_options:); end
 
     sig do
       params(
diff --git a/test/workos/test_audit_logs.rb b/test/workos/test_audit_logs.rb
index c449bb40..764e2674 100644
--- a/test/workos/test_audit_logs.rb
+++ b/test/workos/test_audit_logs.rb
@@ -42,7 +42,7 @@ def test_list_action_schemas_returns_expected_result
   def test_create_schema_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/audit_logs/actions/stub/schemas(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.audit_logs.create_schema(action_name: "stub", targets: [])
+    result = @client.audit_logs.create_schema(action_name: "stub", targets: [{}])
     refute_nil result
   end
 
@@ -73,7 +73,7 @@ def test_get_export_returns_expected_result
     {name: :update_organization_audit_logs_retention, verb: :put, url: %r{\Ahttps://api\.workos\.com/organizations/stub/audit_logs_retention(\?|\z)}, args: {id: "stub", retention_period_in_days: 1}},
     {name: :list_actions, verb: :get, url: %r{\Ahttps://api\.workos\.com/audit_logs/actions(\?|\z)}},
     {name: :list_action_schemas, verb: :get, url: %r{\Ahttps://api\.workos\.com/audit_logs/actions/stub/schemas(\?|\z)}, args: {action_name: "stub"}},
-    {name: :create_schema, verb: :post, url: %r{\Ahttps://api\.workos\.com/audit_logs/actions/stub/schemas(\?|\z)}, args: {action_name: "stub", targets: []}},
+    {name: :create_schema, verb: :post, url: %r{\Ahttps://api\.workos\.com/audit_logs/actions/stub/schemas(\?|\z)}, args: {action_name: "stub", targets: [{}]}},
     {name: :create_event, verb: :post, url: %r{\Ahttps://api\.workos\.com/audit_logs/events(\?|\z)}, args: {organization_id: "stub", event: {}}},
     {name: :create_export, verb: :post, url: %r{\Ahttps://api\.workos\.com/audit_logs/exports(\?|\z)}, args: {organization_id: "stub", range_start: "stub", range_end: "stub"}},
     {name: :get_export, verb: :get, url: %r{\Ahttps://api\.workos\.com/audit_logs/exports/stub(\?|\z)}, args: {audit_log_export_id: "stub"}}
diff --git a/test/workos/test_authorization.rb b/test/workos/test_authorization.rb
index 56c1dfcc..56de8137 100644
--- a/test/workos/test_authorization.rb
+++ b/test/workos/test_authorization.rb
@@ -13,15 +13,31 @@ def setup
 
   def test_check_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/check(\?|\z)})
+      .with(body: hash_including("permission_slug" => "stub", "resource_id" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.check(organization_membership_id: "stub", permission_slug: "stub", resource_target: {type: "by_id"})
+    result = @client.authorization.check(organization_membership_id: "stub", permission_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub"))
+    refute_nil result
+  end
+
+  def test_check_with_resource_target_by_external_id_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/check(\?|\z)})
+      .with(body: hash_including("permission_slug" => "stub", "resource_external_id" => "stub", "resource_type_slug" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.check(organization_membership_id: "stub", permission_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetByExternalId.new(resource_external_id: "stub", resource_type_slug: "stub"))
     refute_nil result
   end
 
   def test_list_resources_for_membership_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
-    result = @client.authorization.list_resources_for_membership(organization_membership_id: "stub", permission_slug: "stub", parent_resource: {type: "by_id"})
+    result = @client.authorization.list_resources_for_membership(organization_membership_id: "stub", permission_slug: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub"))
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_list_resources_for_membership_with_parent_resource_by_external_id_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_resources_for_membership(organization_membership_id: "stub", permission_slug: "stub", parent_resource: WorkOS::Authorization::ParentResourceByExternalId.new(parent_resource_type_slug: "stub", parent_resource_external_id: "stub"))
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
@@ -48,15 +64,31 @@ def test_list_role_assignments_returns_expected_result
 
   def test_assign_role_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)})
+      .with(body: hash_including("role_slug" => "stub", "resource_id" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.assign_role(organization_membership_id: "stub", role_slug: "stub", resource_target: {type: "by_id"})
+    result = @client.authorization.assign_role(organization_membership_id: "stub", role_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub"))
+    refute_nil result
+  end
+
+  def test_assign_role_with_resource_target_by_external_id_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)})
+      .with(body: hash_including("role_slug" => "stub", "resource_external_id" => "stub", "resource_type_slug" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.assign_role(organization_membership_id: "stub", role_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetByExternalId.new(resource_external_id: "stub", resource_type_slug: "stub"))
     refute_nil result
   end
 
   def test_remove_role_returns_expected_result
     stub_request(:delete, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.remove_role(organization_membership_id: "stub", role_slug: "stub", resource_target: {type: "by_id"})
+    result = @client.authorization.remove_role(organization_membership_id: "stub", role_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub"))
+    assert_nil result
+  end
+
+  def test_remove_role_with_resource_target_by_external_id_returns_expected_result
+    stub_request(:delete, %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)})
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.remove_role(organization_membership_id: "stub", role_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetByExternalId.new(resource_external_id: "stub", resource_type_slug: "stub"))
     assert_nil result
   end
 
@@ -112,7 +144,7 @@ def test_add_organization_role_permission_returns_expected_result
   def test_set_organization_role_permissions_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub/permissions(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.set_organization_role_permissions(organization_id: "stub", slug: "stub", permissions: [])
+    result = @client.authorization.set_organization_role_permissions(organization_id: "stub", slug: "stub", permissions: ["stub"])
     refute_nil result
   end
 
@@ -132,8 +164,17 @@ def test_get_resource_by_external_id_returns_expected_result
 
   def test_update_resource_by_external_id_returns_expected_result
     stub_request(:patch, %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)})
+      .with(body: hash_including("parent_resource_id" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.update_resource_by_external_id(organization_id: "stub", resource_type_slug: "stub", external_id: "stub")
+    result = @client.authorization.update_resource_by_external_id(organization_id: "stub", resource_type_slug: "stub", external_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub"))
+    refute_nil result
+  end
+
+  def test_update_resource_by_external_id_with_parent_resource_by_external_id_returns_expected_result
+    stub_request(:patch, %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)})
+      .with(body: hash_including("parent_resource_external_id" => "stub", "parent_resource_type_slug" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.update_resource_by_external_id(organization_id: "stub", resource_type_slug: "stub", external_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceByExternalId.new(parent_resource_external_id: "stub", parent_resource_type_slug: "stub"))
     refute_nil result
   end
 
@@ -154,14 +195,30 @@ def test_list_memberships_for_resource_by_external_id_returns_expected_result
   def test_list_resources_returns_expected_result
     stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)})
       .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
-    result = @client.authorization.list_resources
+    result = @client.authorization.list_resources(parent: WorkOS::Authorization::ParentById.new(parent_resource_id: "stub"))
+    assert_kind_of WorkOS::Types::ListStruct, result
+  end
+
+  def test_list_resources_with_parent_by_external_id_returns_expected_result
+    stub_request(:get, %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)})
+      .to_return(body: '{"data": [], "list_metadata": {}}', status: 200)
+    result = @client.authorization.list_resources(parent: WorkOS::Authorization::ParentByExternalId.new(parent_resource_type_slug: "stub", parent_external_id: "stub"))
     assert_kind_of WorkOS::Types::ListStruct, result
   end
 
   def test_create_resource_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)})
+      .with(body: hash_including("external_id" => "stub", "name" => "stub", "resource_type_slug" => "stub", "organization_id" => "stub", "parent_resource_id" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.create_resource(external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub")
+    result = @client.authorization.create_resource(external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub"))
+    refute_nil result
+  end
+
+  def test_create_resource_with_parent_resource_by_external_id_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)})
+      .with(body: hash_including("external_id" => "stub", "name" => "stub", "resource_type_slug" => "stub", "organization_id" => "stub", "parent_resource_external_id" => "stub", "parent_resource_type_slug" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.create_resource(external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceByExternalId.new(parent_resource_external_id: "stub", parent_resource_type_slug: "stub"))
     refute_nil result
   end
 
@@ -174,8 +231,17 @@ def test_get_resource_returns_expected_result
 
   def test_update_resource_returns_expected_result
     stub_request(:patch, %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)})
+      .with(body: hash_including("parent_resource_id" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.authorization.update_resource(resource_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub"))
+    refute_nil result
+  end
+
+  def test_update_resource_with_parent_resource_by_external_id_returns_expected_result
+    stub_request(:patch, %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)})
+      .with(body: hash_including("parent_resource_external_id" => "stub", "parent_resource_type_slug" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.update_resource(resource_id: "stub")
+    result = @client.authorization.update_resource(resource_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceByExternalId.new(parent_resource_external_id: "stub", parent_resource_type_slug: "stub"))
     refute_nil result
   end
 
@@ -231,7 +297,7 @@ def test_add_environment_role_permission_returns_expected_result
   def test_set_environment_role_permissions_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/authorization/roles/stub/permissions(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.authorization.set_environment_role_permissions(slug: "stub", permissions: [])
+    result = @client.authorization.set_environment_role_permissions(slug: "stub", permissions: ["stub"])
     refute_nil result
   end
 
@@ -272,13 +338,13 @@ def test_delete_permission_returns_expected_result
 
   # Parameterized authentication error tests (one per endpoint).
   [
-    {name: :check, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/check(\?|\z)}, args: {organization_membership_id: "stub", permission_slug: "stub", resource_target: {type: "by_id"}}},
-    {name: :list_resources_for_membership, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources(\?|\z)}, args: {organization_membership_id: "stub", permission_slug: "stub", parent_resource: {type: "by_id"}}},
+    {name: :check, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/check(\?|\z)}, args: {organization_membership_id: "stub", permission_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub")}},
+    {name: :list_resources_for_membership, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources(\?|\z)}, args: {organization_membership_id: "stub", permission_slug: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :list_effective_permissions, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources/stub/permissions(\?|\z)}, args: {organization_membership_id: "stub", resource_id: "stub"}},
     {name: :list_effective_permissions_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/resources/stub/stub/permissions(\?|\z)}, args: {organization_membership_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
     {name: :list_role_assignments, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)}, args: {organization_membership_id: "stub"}},
-    {name: :assign_role, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)}, args: {organization_membership_id: "stub", role_slug: "stub", resource_target: {type: "by_id"}}},
-    {name: :remove_role, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)}, args: {organization_membership_id: "stub", role_slug: "stub", resource_target: {type: "by_id"}}},
+    {name: :assign_role, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)}, args: {organization_membership_id: "stub", role_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub")}},
+    {name: :remove_role, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments(\?|\z)}, args: {organization_membership_id: "stub", role_slug: "stub", resource_target: WorkOS::Authorization::ResourceTargetById.new(resource_id: "stub")}},
     {name: :remove_role_assignment, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organization_memberships/stub/role_assignments/stub(\?|\z)}, args: {organization_membership_id: "stub", role_assignment_id: "stub"}},
     {name: :list_organization_roles, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles(\?|\z)}, args: {organization_id: "stub"}},
     {name: :create_organization_role, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles(\?|\z)}, args: {organization_id: "stub", name: "stub"}},
@@ -286,16 +352,16 @@ def test_delete_permission_returns_expected_result
     {name: :update_organization_role, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub(\?|\z)}, args: {organization_id: "stub", slug: "stub"}},
     {name: :delete_organization_role, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub(\?|\z)}, args: {organization_id: "stub", slug: "stub"}},
     {name: :add_organization_role_permission, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub/permissions(\?|\z)}, args: {organization_id: "stub", slug: "stub", body_slug: "stub"}},
-    {name: :set_organization_role_permissions, verb: :put, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub/permissions(\?|\z)}, args: {organization_id: "stub", slug: "stub", permissions: []}},
+    {name: :set_organization_role_permissions, verb: :put, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub/permissions(\?|\z)}, args: {organization_id: "stub", slug: "stub", permissions: ["stub"]}},
     {name: :remove_organization_role_permission, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/roles/stub/permissions/stub(\?|\z)}, args: {organization_id: "stub", slug: "stub", permission_slug: "stub"}},
     {name: :get_resource_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
-    {name: :update_resource_by_external_id, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
+    {name: :update_resource_by_external_id, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :delete_resource_by_external_id, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub"}},
     {name: :list_memberships_for_resource_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/organizations/stub/resources/stub/stub/organization_memberships(\?|\z)}, args: {organization_id: "stub", resource_type_slug: "stub", external_id: "stub", permission_slug: "stub"}},
-    {name: :list_resources, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}},
-    {name: :create_resource, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub"}},
+    {name: :list_resources, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {parent: WorkOS::Authorization::ParentById.new(parent_resource_id: "stub")}},
+    {name: :create_resource, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/resources(\?|\z)}, args: {external_id: "stub", name: "stub", resource_type_slug: "stub", organization_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :get_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
-    {name: :update_resource, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
+    {name: :update_resource, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub", parent_resource: WorkOS::Authorization::ParentResourceById.new(parent_resource_id: "stub")}},
     {name: :delete_resource, verb: :delete, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub(\?|\z)}, args: {resource_id: "stub"}},
     {name: :list_memberships_for_resource, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/resources/stub/organization_memberships(\?|\z)}, args: {resource_id: "stub", permission_slug: "stub"}},
     {name: :list_environment_roles, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/roles(\?|\z)}},
@@ -303,7 +369,7 @@ def test_delete_permission_returns_expected_result
     {name: :get_environment_role, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub(\?|\z)}, args: {slug: "stub"}},
     {name: :update_environment_role, verb: :patch, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub(\?|\z)}, args: {slug: "stub"}},
     {name: :add_environment_role_permission, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub/permissions(\?|\z)}, args: {slug: "stub", body_slug: "stub"}},
-    {name: :set_environment_role_permissions, verb: :put, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub/permissions(\?|\z)}, args: {slug: "stub", permissions: []}},
+    {name: :set_environment_role_permissions, verb: :put, url: %r{\Ahttps://api\.workos\.com/authorization/roles/stub/permissions(\?|\z)}, args: {slug: "stub", permissions: ["stub"]}},
     {name: :list_permissions, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/permissions(\?|\z)}},
     {name: :create_permission, verb: :post, url: %r{\Ahttps://api\.workos\.com/authorization/permissions(\?|\z)}, args: {slug: "stub", name: "stub"}},
     {name: :get_permission, verb: :get, url: %r{\Ahttps://api\.workos\.com/authorization/permissions/stub(\?|\z)}, args: {slug: "stub"}},
diff --git a/test/workos/test_user_management.rb b/test/workos/test_user_management.rb
index 6456408a..f2520e0b 100644
--- a/test/workos/test_user_management.rb
+++ b/test/workos/test_user_management.rb
@@ -203,8 +203,17 @@ def test_list_users_returns_expected_result
 
   def test_create_user_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)})
+      .with(body: hash_including("email" => "stub", "password" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_user(email: "stub")
+    result = @client.user_management.create_user(email: "stub", password: WorkOS::UserManagement::PasswordPlaintext.new(password: "stub"))
+    refute_nil result
+  end
+
+  def test_create_user_with_password_hashed_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)})
+      .with(body: hash_including("email" => "stub", "password_hash" => "stub", "password_hash_type" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.create_user(email: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub"))
     refute_nil result
   end
 
@@ -224,8 +233,17 @@ def test_get_user_returns_expected_result
 
   def test_update_user_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)})
+      .with(body: hash_including("password" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.update_user(id: "stub", password: WorkOS::UserManagement::PasswordPlaintext.new(password: "stub"))
+    refute_nil result
+  end
+
+  def test_update_user_with_password_hashed_returns_expected_result
+    stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)})
+      .with(body: hash_including("password_hash" => "stub", "password_hash_type" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.update_user(id: "stub")
+    result = @client.user_management.update_user(id: "stub", password: WorkOS::UserManagement::PasswordHashed.new(password_hash: "stub", password_hash_type: "stub"))
     refute_nil result
   end
 
@@ -357,8 +375,17 @@ def test_list_organization_memberships_returns_expected_result
 
   def test_create_organization_membership_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)})
+      .with(body: hash_including("user_id" => "stub", "organization_id" => "stub", "role_slug" => "stub"))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.create_organization_membership(user_id: "stub", organization_id: "stub")
+    result = @client.user_management.create_organization_membership(user_id: "stub", organization_id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub"))
+    refute_nil result
+  end
+
+  def test_create_organization_membership_with_role_multiple_returns_expected_result
+    stub_request(:post, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)})
+      .with(body: hash_including("user_id" => "stub", "organization_id" => "stub", "role_slugs" => ["stub"]))
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.create_organization_membership(user_id: "stub", organization_id: "stub", role: WorkOS::UserManagement::RoleMultiple.new(role_slugs: ["stub"]))
     refute_nil result
   end
 
@@ -371,8 +398,17 @@ def test_get_organization_membership_returns_expected_result
 
   def test_update_organization_membership_returns_expected_result
     stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)})
+      .with(body: hash_including("role_slug" => "stub"))
+      .to_return(body: "{}", status: 200)
+    result = @client.user_management.update_organization_membership(id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub"))
+    refute_nil result
+  end
+
+  def test_update_organization_membership_with_role_multiple_returns_expected_result
+    stub_request(:put, %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)})
+      .with(body: hash_including("role_slugs" => ["stub"]))
       .to_return(body: "{}", status: 200)
-    result = @client.user_management.update_organization_membership(id: "stub")
+    result = @client.user_management.update_organization_membership(id: "stub", role: WorkOS::UserManagement::RoleMultiple.new(role_slugs: ["stub"]))
     refute_nil result
   end
 
@@ -430,10 +466,10 @@ def test_delete_user_authorized_application_returns_expected_result
     {name: :confirm_password_reset, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/password_reset/confirm(\?|\z)}, args: {token: "stub", new_password: "stub"}},
     {name: :get_password_reset, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/password_reset/stub(\?|\z)}, args: {id: "stub"}},
     {name: :list_users, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)}},
-    {name: :create_user, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)}, args: {email: "stub"}},
+    {name: :create_user, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/users(\?|\z)}, args: {email: "stub", password: WorkOS::UserManagement::PasswordPlaintext.new(password: "stub")}},
     {name: :get_user_by_external_id, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users/external_id/stub(\?|\z)}, args: {external_id: "stub"}},
     {name: :get_user, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)}, args: {id: "stub"}},
-    {name: :update_user, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)}, args: {id: "stub"}},
+    {name: :update_user, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)}, args: {id: "stub", password: WorkOS::UserManagement::PasswordPlaintext.new(password: "stub")}},
     {name: :delete_user, verb: :delete, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub(\?|\z)}, args: {id: "stub"}},
     {name: :confirm_email_change, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/email_change/confirm(\?|\z)}, args: {id: "stub", code: "stub"}},
     {name: :send_email_change, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/users/stub/email_change/send(\?|\z)}, args: {id: "stub", new_email: "stub"}},
@@ -452,9 +488,9 @@ def test_delete_user_authorized_application_returns_expected_result
     {name: :create_magic_auth, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/magic_auth(\?|\z)}, args: {email: "stub"}},
     {name: :get_magic_auth, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/magic_auth/stub(\?|\z)}, args: {id: "stub"}},
     {name: :list_organization_memberships, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)}},
-    {name: :create_organization_membership, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)}, args: {user_id: "stub", organization_id: "stub"}},
+    {name: :create_organization_membership, verb: :post, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships(\?|\z)}, args: {user_id: "stub", organization_id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub")}},
     {name: :get_organization_membership, verb: :get, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub"}},
-    {name: :update_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub"}},
+    {name: :update_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub", role: WorkOS::UserManagement::RoleSingle.new(role_slug: "stub")}},
     {name: :delete_organization_membership, verb: :delete, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub(\?|\z)}, args: {id: "stub"}},
     {name: :deactivate_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub/deactivate(\?|\z)}, args: {id: "stub"}},
     {name: :reactivate_organization_membership, verb: :put, url: %r{\Ahttps://api\.workos\.com/user_management/organization_memberships/stub/reactivate(\?|\z)}, args: {id: "stub"}},
diff --git a/test/workos/test_webhooks.rb b/test/workos/test_webhooks.rb
index ddf268f0..1a10bbf2 100644
--- a/test/workos/test_webhooks.rb
+++ b/test/workos/test_webhooks.rb
@@ -21,7 +21,7 @@ def test_list_webhook_endpoints_returns_expected_result
   def test_create_webhook_endpoint_returns_expected_result
     stub_request(:post, %r{\Ahttps://api\.workos\.com/webhook_endpoints(\?|\z)})
       .to_return(body: "{}", status: 200)
-    result = @client.webhooks.create_webhook_endpoint(endpoint_url: "stub", events: [])
+    result = @client.webhooks.create_webhook_endpoint(endpoint_url: "stub", events: ["stub"])
     refute_nil result
   end
 
@@ -42,7 +42,7 @@ def test_delete_webhook_endpoint_returns_expected_result
   # Parameterized authentication error tests (one per endpoint).
   [
     {name: :list_webhook_endpoints, verb: :get, url: %r{\Ahttps://api\.workos\.com/webhook_endpoints(\?|\z)}},
-    {name: :create_webhook_endpoint, verb: :post, url: %r{\Ahttps://api\.workos\.com/webhook_endpoints(\?|\z)}, args: {endpoint_url: "stub", events: []}},
+    {name: :create_webhook_endpoint, verb: :post, url: %r{\Ahttps://api\.workos\.com/webhook_endpoints(\?|\z)}, args: {endpoint_url: "stub", events: ["stub"]}},
     {name: :update_webhook_endpoint, verb: :patch, url: %r{\Ahttps://api\.workos\.com/webhook_endpoints/stub(\?|\z)}, args: {id: "stub"}},
     {name: :delete_webhook_endpoint, verb: :delete, url: %r{\Ahttps://api\.workos\.com/webhook_endpoints/stub(\?|\z)}, args: {id: "stub"}}
   ].each do |spec|