feat: cross app access, branding theme identifiers, session actor, and SS-EC third-party config (#877)

## Changes

### New Features

New optional parameters on existing client methods (sync + async); no
new standalone endpoints:

- **Cross App Access (ID-JAG)**
- `clients.create()` / `clients.update()`: new optional
`identity_assertion_authorization_grant` (`{active: bool}`).
- `connections.create()` / `connections.update()`: new optional
`cross_app_access_resource_app` (`{status: "enabled" | "disabled"}`).
- **Branding themes**
- `branding.themes.create()` / `branding.themes.update()`: new optional
`identifiers` (`BrandingThemeIdentifiers`) — `{login_display: "separate"
| "unified", otp_autocomplete: bool, phone_display: {formatting:
"international" | "regional", masking: "hide_country_code" |
"mask_digits" | "show_all"}}`.
- **Self-Service Profiles — SSO ticket**
- `self_service_profiles.sso_ticket.create()`: new optional
`third_party_client_access_config` (`{allow_configuration: bool}`).

### Type Changes

- `Client`: new optional `identity_assertion_authorization_grant:
IdentityAssertionAuthorizationGrant`.
- Connection request/response/list types
(`CreateConnectionRequestContentOidc`,
`UpdateConnectionRequestContentOidc`, `ConnectionResponseContentOidc`,
`ConnectionForList`): new optional `cross_app_access_resource_app`.
- Session response types (`SessionResponseContent`,
`GetSessionResponseContent`, `UpdateSessionResponseContent`): new
optional `actor: SessionActorMetadata` (`{sub: str}` plus up to 5
additional primitive claims; `SessionActorClaimValue = Union[str, bool,
float]`).
- `SuspiciousIpThrottlingStage`: new optional
`pre_custom_token_exchange` (wire alias `pre-custom-token-exchange`) →
`SuspiciousIpThrottlingPreCustomTokenExchangeStage` (`{max_attempts?:
int, rate?: int}`).

### New Types

All are exported from both `auth0.management` and
`auth0.management.types`, and back the fields above:

- **Connections — `cross_app_access_resource_app`**
(`connections.create()` / `.update()` params; connection response/list
types): `CreateCrossAppAccessResourceApp`,
`UpdateCrossAppAccessResourceApp` (request),
`ConnectionCrossAppAccessResourceApp`, `CrossAppAccessResourceApp`
(response), `CrossAppAccessResourceAppStatusEnum`,
`ConnectionCrossAppAccessResourceAppStatusEnum`.
- **Clients — `identity_assertion_authorization_grant`**
(`clients.create()` / `.update()` params; `Client` response):
`CreateIdentityAssertionAuthorizationGrant`,
`UpdateIdentityAssertionAuthorizationGrant` (request),
`IdentityAssertionAuthorizationGrant` (response).
- **Branding themes — `identifiers`** (`branding.themes.create()` /
`.update()` params): `BrandingThemeIdentifiers`,
`BrandingThemeIdentifiersLoginDisplayEnum`,
`BrandingThemeIdentifiersPhoneDisplay`,
`BrandingThemeIdentifiersPhoneDisplayFormattingEnum`,
`BrandingThemeIdentifiersPhoneDisplayMaskingEnum`.
- **Self-Service Profiles — `third_party_client_access_config`**
(`self_service_profiles.sso_ticket.create()` param):
`ThirdPartyClientAccessConfig`.
- **Sessions — `actor`** (session response types):
`SessionActorMetadata`, `SessionActorClaimValue`.
- **Attack Protection — `pre_custom_token_exchange`** (on
`SuspiciousIpThrottlingStage`):
`SuspiciousIpThrottlingPreCustomTokenExchangeStage`.


### Enum Additions

- `ClientGrantSubjectTypeEnum`: adds `"anonymous_user"`.
- `ClientAppTypeEnum`: adds `"b2b_integration"`.

Author: rmad17

.fern/replay.lock

@@ -1528,7 +1528,7 @@ client.clients.list(
 <dl>
 <dd>
 
-**external_client_id:** `typing.Optional[str]` — Optional filter by the <a href="https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-04.html">Client ID Metadata Document</a> URI for CIMD-registered clients.
+**external_client_id:** `typing.Optional[str]` — Optional filter by the <a href="https://drafts.oauth.net/draft-ietf-oauth-client-id-metadata-document/draft-ietf-oauth-client-id-metadata-document.html">Client ID Metadata Document</a> URI for CIMD-registered clients.
 
 </dd>
 </dl>
@@ -2026,6 +2026,14 @@ See https://auth0.com/docs/secure/security-guidance/measures-against-app-imperso
 <dl>
 <dd>
 
+**identity_assertion_authorization_grant:** `typing.Optional[CreateIdentityAssertionAuthorizationGrant]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **third_party_security_mode:** `typing.Optional[ClientThirdPartySecurityModeEnum]` 
 
 </dd>
@@ -2726,6 +2734,14 @@ client.clients.update(
 <dl>
 <dd>
 
+**identity_assertion_authorization_grant:** `typing.Optional[UpdateIdentityAssertionAuthorizationGrant]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **form_template:** `typing.Optional[str]` — Form template for WS-Federation protocol
 
 </dd>
@@ -3915,6 +3931,14 @@ client.connections.create(
 <dl>
 <dd>
 
+**cross_app_access_resource_app:** `typing.Optional[CreateCrossAppAccessResourceApp]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -4236,6 +4260,14 @@ client.connections.update(
 <dl>
 <dd>
 
+**cross_app_access_resource_app:** `typing.Optional[UpdateCrossAppAccessResourceApp]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -20137,6 +20169,14 @@ client.branding.themes.create(
 <dl>
 <dd>
 
+**identifiers:** `typing.Optional[BrandingThemeIdentifiers]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -20537,6 +20577,14 @@ client.branding.themes.update(
 <dl>
 <dd>
 
+**identifiers:** `typing.Optional[BrandingThemeIdentifiers]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -35837,6 +35885,14 @@ client.self_service_profiles.sso_ticket.create(
 <dl>
 <dd>
 
+**third_party_client_access_config:** `typing.Optional[ThirdPartyClientAccessConfig]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **enabled_features:** `typing.Optional[SelfServiceProfileSsoTicketEnabledFeatures]` 
 
 </dd>

reference.md

@@ -110,6 +110,11 @@
         BrandingThemeFontSubtitle,
         BrandingThemeFontTitle,
         BrandingThemeFonts,
+        BrandingThemeIdentifiers,
+        BrandingThemeIdentifiersLoginDisplayEnum,
+        BrandingThemeIdentifiersPhoneDisplay,
+        BrandingThemeIdentifiersPhoneDisplayFormattingEnum,
+        BrandingThemeIdentifiersPhoneDisplayMaskingEnum,
         BrandingThemePageBackground,
         BrandingThemePageBackgroundPageLayoutEnum,
         BrandingThemeWidget,
@@ -320,6 +325,8 @@
         ConnectionConnectedAccountsPurposeXaa,
         ConnectionConnectionSettings,
         ConnectionConnectionSettingsPkceEnum,
+        ConnectionCrossAppAccessResourceApp,
+        ConnectionCrossAppAccessResourceAppStatusEnum,
         ConnectionCustomHeadersOAuth2,
         ConnectionCustomScripts,
         ConnectionDebugSaml,
@@ -883,6 +890,7 @@
         CreateConnectionRequestContentYandex,
         CreateConnectionRequestContentYandexStrategy,
         CreateConnectionResponseContent,
+        CreateCrossAppAccessResourceApp,
         CreateCustomDomainResponseContent,
         CreateDirectoryProvisioningRequestContent,
         CreateDirectoryProvisioningResponseContent,
@@ -978,6 +986,7 @@
         CreateGuardianEnrollmentTicketResponseContent,
         CreateHookResponseContent,
         CreateHookSecretRequestContent,
+        CreateIdentityAssertionAuthorizationGrant,
         CreateImportUsersResponseContent,
         CreateLogStreamDatadogRequestBody,
         CreateLogStreamEventBridgeRequestBody,
@@ -1018,6 +1027,8 @@
         CredentialDeviceTypeEnum,
         CredentialId,
         CrossAppAccessRequestingApp,
+        CrossAppAccessResourceApp,
+        CrossAppAccessResourceAppStatusEnum,
         CspDirectives,
         CspFlag,
         CspFlags,
@@ -2541,6 +2552,7 @@
         HookTriggerIdEnum,
         HttpCustomHeader,
         Identity,
+        IdentityAssertionAuthorizationGrant,
         IdentityProviderEnum,
         IdentityProviderOnlyAuth0Enum,
         ImportEncryptionKeyResponseContent,
@@ -2849,6 +2861,8 @@
         SelfServiceProfileSsoTicketProvisioningScopeEnum,
         SelfServiceProfileUserAttribute,
         SelfServiceProfileUserAttributes,
+        SessionActorClaimValue,
+        SessionActorMetadata,
         SessionAuthenticationSignal,
         SessionAuthenticationSignals,
         SessionClientMetadata,
@@ -2898,6 +2912,7 @@
         SupportedLocales,
         SuspiciousIpThrottlingAllowlist,
         SuspiciousIpThrottlingAllowlistItem,
+        SuspiciousIpThrottlingPreCustomTokenExchangeStage,
         SuspiciousIpThrottlingPreLoginStage,
         SuspiciousIpThrottlingPreUserRegistrationStage,
         SuspiciousIpThrottlingShieldsEnum,
@@ -2926,6 +2941,7 @@
         TestActionResultPayload,
         TestCustomDomainResponseContent,
         TestEventDataContent,
+        ThirdPartyClientAccessConfig,
         TokenExchangeProfileResponseContent,
         TokenExchangeProfileTypeEnum,
         TokenQuota,
@@ -3017,6 +3033,7 @@
         UpdateConnectionRequestContentYahoo,
         UpdateConnectionRequestContentYandex,
         UpdateConnectionResponseContent,
+        UpdateCrossAppAccessResourceApp,
         UpdateCustomDomainResponseContent,
         UpdateDefaultCanonicalDomainResponseContent,
         UpdateDefaultCustomDomainResponseContent,
@@ -3039,6 +3056,7 @@
         UpdateGuardianFactorsProviderPushNotificationSnsResponseContent,
         UpdateHookResponseContent,
         UpdateHookSecretRequestContent,
+        UpdateIdentityAssertionAuthorizationGrant,
         UpdateLogStreamResponseContent,
         UpdateNetworkAclResponseContent,
         UpdateOrganizationAllConnectionResponseContent,
@@ -3302,6 +3320,11 @@
     "BrandingThemeFontSubtitle": ".types",
     "BrandingThemeFontTitle": ".types",
     "BrandingThemeFonts": ".types",
+    "BrandingThemeIdentifiers": ".types",
+    "BrandingThemeIdentifiersLoginDisplayEnum": ".types",
+    "BrandingThemeIdentifiersPhoneDisplay": ".types",
+    "BrandingThemeIdentifiersPhoneDisplayFormattingEnum": ".types",
+    "BrandingThemeIdentifiersPhoneDisplayMaskingEnum": ".types",
     "BrandingThemePageBackground": ".types",
     "BrandingThemePageBackgroundPageLayoutEnum": ".types",
     "BrandingThemeWidget": ".types",
@@ -3513,6 +3536,8 @@
     "ConnectionConnectedAccountsPurposeXaa": ".types",
     "ConnectionConnectionSettings": ".types",
     "ConnectionConnectionSettingsPkceEnum": ".types",
+    "ConnectionCrossAppAccessResourceApp": ".types",
+    "ConnectionCrossAppAccessResourceAppStatusEnum": ".types",
     "ConnectionCustomHeadersOAuth2": ".types",
     "ConnectionCustomScripts": ".types",
     "ConnectionDebugSaml": ".types",
@@ -4077,6 +4102,7 @@
     "CreateConnectionRequestContentYandex": ".types",
     "CreateConnectionRequestContentYandexStrategy": ".types",
     "CreateConnectionResponseContent": ".types",
+    "CreateCrossAppAccessResourceApp": ".types",
     "CreateCustomDomainResponseContent": ".types",
     "CreateDirectoryProvisioningRequestContent": ".types",
     "CreateDirectoryProvisioningResponseContent": ".types",
@@ -4172,6 +4198,7 @@
     "CreateGuardianEnrollmentTicketResponseContent": ".types",
     "CreateHookResponseContent": ".types",
     "CreateHookSecretRequestContent": ".types",
+    "CreateIdentityAssertionAuthorizationGrant": ".types",
     "CreateImportUsersResponseContent": ".types",
     "CreateLogStreamDatadogRequestBody": ".types",
     "CreateLogStreamEventBridgeRequestBody": ".types",
@@ -4212,6 +4239,8 @@
     "CredentialDeviceTypeEnum": ".types",
     "CredentialId": ".types",
     "CrossAppAccessRequestingApp": ".types",
+    "CrossAppAccessResourceApp": ".types",
+    "CrossAppAccessResourceAppStatusEnum": ".types",
     "CspDirectives": ".types",
     "CspFlag": ".types",
     "CspFlags": ".types",
@@ -5741,6 +5770,7 @@
     "HookTriggerIdEnum": ".types",
     "HttpCustomHeader": ".types",
     "Identity": ".types",
+    "IdentityAssertionAuthorizationGrant": ".types",
     "IdentityProviderEnum": ".types",
     "IdentityProviderOnlyAuth0Enum": ".types",
     "ImportEncryptionKeyResponseContent": ".types",
@@ -6055,6 +6085,8 @@
     "SelfServiceProfileUserAttribute": ".types",
     "SelfServiceProfileUserAttributes": ".types",
     "ServiceUnavailableError": ".errors",
+    "SessionActorClaimValue": ".types",
+    "SessionActorMetadata": ".types",
     "SessionAuthenticationSignal": ".types",
     "SessionAuthenticationSignals": ".types",
     "SessionClientMetadata": ".types",
@@ -6104,6 +6136,7 @@
     "SupportedLocales": ".types",
     "SuspiciousIpThrottlingAllowlist": ".types",
     "SuspiciousIpThrottlingAllowlistItem": ".types",
+    "SuspiciousIpThrottlingPreCustomTokenExchangeStage": ".types",
     "SuspiciousIpThrottlingPreLoginStage": ".types",
     "SuspiciousIpThrottlingPreUserRegistrationStage": ".types",
     "SuspiciousIpThrottlingShieldsEnum": ".types",
@@ -6132,6 +6165,7 @@
     "TestActionResultPayload": ".types",
     "TestCustomDomainResponseContent": ".types",
     "TestEventDataContent": ".types",
+    "ThirdPartyClientAccessConfig": ".types",
     "TokenExchangeProfileResponseContent": ".types",
     "TokenExchangeProfileTypeEnum": ".types",
     "TokenProvider": ".token_provider",
@@ -6226,6 +6260,7 @@
     "UpdateConnectionRequestContentYahoo": ".types",
     "UpdateConnectionRequestContentYandex": ".types",
     "UpdateConnectionResponseContent": ".types",
+    "UpdateCrossAppAccessResourceApp": ".types",
     "UpdateCustomDomainResponseContent": ".types",
     "UpdateDefaultCanonicalDomainResponseContent": ".types",
     "UpdateDefaultCustomDomainResponseContent": ".types",
@@ -6248,6 +6283,7 @@
     "UpdateGuardianFactorsProviderPushNotificationSnsResponseContent": ".types",
     "UpdateHookResponseContent": ".types",
     "UpdateHookSecretRequestContent": ".types",
+    "UpdateIdentityAssertionAuthorizationGrant": ".types",
     "UpdateLogStreamResponseContent": ".types",
     "UpdateNetworkAclResponseContent": ".types",
     "UpdateOrganizationAllConnectionResponseContent": ".types",
@@ -6512,6 +6548,11 @@ def __dir__():
     "BrandingThemeFontSubtitle",
     "BrandingThemeFontTitle",
     "BrandingThemeFonts",
+    "BrandingThemeIdentifiers",
+    "BrandingThemeIdentifiersLoginDisplayEnum",
+    "BrandingThemeIdentifiersPhoneDisplay",
+    "BrandingThemeIdentifiersPhoneDisplayFormattingEnum",
+    "BrandingThemeIdentifiersPhoneDisplayMaskingEnum",
     "BrandingThemePageBackground",
     "BrandingThemePageBackgroundPageLayoutEnum",
     "BrandingThemeWidget",
@@ -6723,6 +6764,8 @@ def __dir__():
     "ConnectionConnectedAccountsPurposeXaa",
     "ConnectionConnectionSettings",
     "ConnectionConnectionSettingsPkceEnum",
+    "ConnectionCrossAppAccessResourceApp",
+    "ConnectionCrossAppAccessResourceAppStatusEnum",
     "ConnectionCustomHeadersOAuth2",
     "ConnectionCustomScripts",
     "ConnectionDebugSaml",
@@ -7287,6 +7330,7 @@ def __dir__():
     "CreateConnectionRequestContentYandex",
     "CreateConnectionRequestContentYandexStrategy",
     "CreateConnectionResponseContent",
+    "CreateCrossAppAccessResourceApp",
     "CreateCustomDomainResponseContent",
     "CreateDirectoryProvisioningRequestContent",
     "CreateDirectoryProvisioningResponseContent",
@@ -7382,6 +7426,7 @@ def __dir__():
     "CreateGuardianEnrollmentTicketResponseContent",
     "CreateHookResponseContent",
     "CreateHookSecretRequestContent",
+    "CreateIdentityAssertionAuthorizationGrant",
     "CreateImportUsersResponseContent",
     "CreateLogStreamDatadogRequestBody",
     "CreateLogStreamEventBridgeRequestBody",
@@ -7422,6 +7467,8 @@ def __dir__():
     "CredentialDeviceTypeEnum",
     "CredentialId",
     "CrossAppAccessRequestingApp",
+    "CrossAppAccessResourceApp",
+    "CrossAppAccessResourceAppStatusEnum",
     "CspDirectives",
     "CspFlag",
     "CspFlags",
@@ -8951,6 +8998,7 @@ def __dir__():
     "HookTriggerIdEnum",
     "HttpCustomHeader",
     "Identity",
+    "IdentityAssertionAuthorizationGrant",
     "IdentityProviderEnum",
     "IdentityProviderOnlyAuth0Enum",
     "ImportEncryptionKeyResponseContent",
@@ -9265,6 +9313,8 @@ def __dir__():
     "SelfServiceProfileUserAttribute",
     "SelfServiceProfileUserAttributes",
     "ServiceUnavailableError",
+    "SessionActorClaimValue",
+    "SessionActorMetadata",
     "SessionAuthenticationSignal",
     "SessionAuthenticationSignals",
     "SessionClientMetadata",
@@ -9314,6 +9364,7 @@ def __dir__():
     "SupportedLocales",
     "SuspiciousIpThrottlingAllowlist",
     "SuspiciousIpThrottlingAllowlistItem",
+    "SuspiciousIpThrottlingPreCustomTokenExchangeStage",
     "SuspiciousIpThrottlingPreLoginStage",
     "SuspiciousIpThrottlingPreUserRegistrationStage",
     "SuspiciousIpThrottlingShieldsEnum",
@@ -9342,6 +9393,7 @@ def __dir__():
     "TestActionResultPayload",
     "TestCustomDomainResponseContent",
     "TestEventDataContent",
+    "ThirdPartyClientAccessConfig",
     "TokenExchangeProfileResponseContent",
     "TokenExchangeProfileTypeEnum",
     "TokenProvider",
@@ -9436,6 +9488,7 @@ def __dir__():
     "UpdateConnectionRequestContentYahoo",
     "UpdateConnectionRequestContentYandex",
     "UpdateConnectionResponseContent",
+    "UpdateCrossAppAccessResourceApp",
     "UpdateCustomDomainResponseContent",
     "UpdateDefaultCanonicalDomainResponseContent",
     "UpdateDefaultCustomDomainResponseContent",
@@ -9458,6 +9511,7 @@ def __dir__():
     "UpdateGuardianFactorsProviderPushNotificationSnsResponseContent",
     "UpdateHookResponseContent",
     "UpdateHookSecretRequestContent",
+    "UpdateIdentityAssertionAuthorizationGrant",
     "UpdateLogStreamResponseContent",
     "UpdateNetworkAclResponseContent",
     "UpdateOrganizationAllConnectionResponseContent",