feat: add retry support, FedCM login types, and error schemas (#841)

### Changes

- Added configurable `max_retries` parameter to `Auth0` and `AsyncAuth0`
clients (defaults to 2 with exponential backoff)
- New error types: `BadRequestSchema`, `ForbiddenSchema`,
`UnauthorizedSchema`, `TooManyRequestsSchema`
- New types: `FedCmLogin`, `FedCmLoginGoogle`,
`CredentialDeviceTypeEnum`
- Extended `user_authentication_method` and `resource_server` response
types with additional fields
- Updated connection types with additional validation fields
- Expanded `clients`, `refresh_tokens`, `resource_servers`, `tickets`,
and `users/authentication_methods` endpoint parameters

### Testing

- Wire tests cover new and updated endpoints
- CI matrix runs on Python 3.10, 3.11, 3.12, 3.13

- [ ] This change adds unit test coverage
- [x] This change has been tested on the latest version of the
platform/language or why not

### Checklist

- [x] I have read the [Auth0 general contribution
guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [x] I have read the [Auth0 Code of
Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [x] All existing and new tests complete without errors

---------

Co-authored-by: fern-api <115122769+fern-api[bot]@users.noreply.github.com>
Co-authored-by: Fern Support <126544928+fern-support@users.noreply.github.com>
Co-authored-by: Tanmay Singh <tstanmay13@gmail.com>
Co-authored-by: Kunal Dawar <35455566+developerkunal@users.noreply.github.com>
Co-authored-by: Kunal Dawar <kunal.dawar@okta.com>

Author: 4 people

.fern/replay.lock

@@ -20,9 +20,6 @@ tests/authentication/
 src/auth0/__init__.py
 src/auth0/py.typed
 
-# Telemetry customization (Auth0 format with dynamic versioning)
-src/auth0/management/core/client_wrapper.py
-
 # Files edited to incorporate both APIs
 pyproject.toml
 poetry.lock

.fernignore

@@ -0,0 +1,125 @@
+# Contributing
+
+Thanks for your interest in contributing to this SDK! This document provides guidelines for contributing to the project.
+
+## Getting Started
+
+### Prerequisites
+
+- Python 3.9+
+- pip
+- poetry
+
+### Installation
+
+Install the project dependencies:
+
+```bash
+poetry install
+```
+
+### Building
+
+Build the project:
+
+```bash
+poetry build
+```
+
+### Testing
+
+Run the test suite:
+
+```bash
+poetry run pytest
+```
+
+### Linting and Formatting
+
+Check code style:
+
+```bash
+poetry run ruff check .
+poetry run ruff format .
+```
+
+### Type Checking
+
+Run the type checker:
+
+```bash
+poetry run mypy .
+```
+
+## About Generated Code
+
+**Important**: Most files in this SDK are automatically generated by [Fern](https://buildwithfern.com) from the API definition. Direct modifications to generated files will be overwritten the next time the SDK is generated.
+
+### Generated Files
+
+The following directories contain generated code:
+- `src/` - API client classes and types
+- Most Python files in the project
+
+### How to Customize
+
+If you need to customize the SDK, you have two options:
+
+#### Option 1: Use `.fernignore`
+
+For custom code that should persist across SDK regenerations:
+
+1. Create a `.fernignore` file in the project root
+2. Add file patterns for files you want to preserve (similar to `.gitignore` syntax)
+3. Add your custom code to those files
+
+Files listed in `.fernignore` will not be overwritten when the SDK is regenerated.
+
+For more information, see the [Fern documentation on custom code](https://buildwithfern.com/learn/sdks/overview/custom-code).
+
+#### Option 2: Contribute to the Generator
+
+If you want to change how code is generated for all users of this SDK:
+
+1. The Python SDK generator lives in the [Fern repository](https://github.com/fern-api/fern)
+2. Generator code is located at `generators/python-v2/`
+3. Follow the [Fern contributing guidelines](https://github.com/fern-api/fern/blob/main/CONTRIBUTING.md)
+4. Submit a pull request with your changes to the generator
+
+This approach is best for:
+- Bug fixes in generated code
+- New features that would benefit all users
+- Improvements to code generation patterns
+
+## Making Changes
+
+### Workflow
+
+1. Create a new branch for your changes
+2. Make your modifications
+3. Run tests to ensure nothing breaks: `poetry run pytest`
+4. Run linting and formatting: `poetry run ruff check .` and `poetry run ruff format .`
+5. Run type checking: `poetry run mypy .`
+6. Build the project: `poetry build`
+7. Commit your changes with a clear commit message
+8. Push your branch and create a pull request
+
+### Commit Messages
+
+Write clear, descriptive commit messages that explain what changed and why.
+
+### Code Style
+
+This project uses automated code formatting and linting. Run `poetry run ruff format .` and `poetry run ruff check .` before committing to ensure your code meets the project's style guidelines.
+
+## Questions or Issues?
+
+If you have questions or run into issues:
+
+1. Check the [Fern documentation](https://buildwithfern.com)
+2. Search existing [GitHub issues](https://github.com/fern-api/fern/issues)
+3. Open a new issue if your question hasn't been addressed
+
+## License
+
+By contributing to this project, you agree that your contributions will be licensed under the same license as the project.

CONTRIBUTING.md

@@ -1902,6 +1902,14 @@ client.clients.create(
 <dl>
 <dd>
 
+**fedcm_login:** `typing.Optional[FedCmLogin]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **refresh_token:** `typing.Optional[ClientRefreshTokenConfiguration]` 
 
 </dd>
@@ -2167,10 +2175,19 @@ client.clients.preview_cimd_metadata(
 <dl>
 <dd>
 
+Idempotent registration for Client ID Metadata Document (CIMD) clients.
+Uses external_client_id as the unique identifier for upsert operations.
+
+<strong>Create:</strong> Returns 201 when a new client is created (requires <code>create:clients</code> scope).
+<strong>Update:</strong> Returns 200 when an existing client is updated (requires <code>update:clients</code> scope).
 
-      Idempotent registration for Client ID Metadata Document (CIMD) clients.
-      Uses external_client_id as the unique identifier for upsert operations.
-      **Create:** Returns 201 when a new client is created (requires \
+This endpoint automatically:
+<ul>
+  <li>Fetches and validates the metadata document</li>
+  <li>Maps CIMD fields to Auth0 client configuration</li>
+  <li>Creates/rotates credentials from the JWKS</li>
+  <li>Enforces CIMD security policies (HTTPS-only, no shared secrets)</li>
+</ul>
 </dd>
 </dl>
 </dd>
@@ -2774,6 +2791,14 @@ client.clients.update(
 <dl>
 <dd>
 
+**fedcm_login:** `typing.Optional[FedCmLogin]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **refresh_token:** `typing.Optional[ClientRefreshTokenConfiguration]` 
 
 </dd>
@@ -10953,6 +10978,14 @@ client.refresh_tokens.revoke()
 <dl>
 <dd>
 
+**audience:** `typing.Optional[str]` — Resource server identifier (audience) to scope the revocation. Must be used with both `user_id` and `client_id`.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -11413,6 +11446,14 @@ client.resource_servers.create(
 <dl>
 <dd>
 
+**allow_online_access_with_ephemeral_sessions:** `typing.Optional[bool]` — Whether Online Refresh Tokens can be issued even when sessions are configured as ephemeral (true) or not (false).
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **token_lifetime:** `typing.Optional[int]` — Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
 
 </dd>
@@ -11777,6 +11818,14 @@ client.resource_servers.update(
 <dl>
 <dd>
 
+**allow_online_access_with_ephemeral_sessions:** `typing.Optional[bool]` — Whether Online Refresh Tokens can be issued even when sessions are configured as ephemeral (true) or not (false).
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **token_lifetime:** `typing.Optional[int]` — Expiration value (in seconds) for access tokens issued for this API from the token endpoint.
 
 </dd>
@@ -14222,7 +14271,7 @@ client.tickets.change_password()
 <dl>
 <dd>
 
-**result_url:** `typing.Optional[str]` — URL the user will be redirected to in the classic Universal Login experience once the ticket is used. Cannot be specified when using client_id or organization_id.
+**result_url:** `typing.Optional[str]` — URL the user will be redirected to in the classic Universal Login experience once the ticket is used. Cannot be specified when using organization_id. May be specified together with client_id when the tenant has a custom password reset page enabled and a password-reset-post-challenge Action bound.
 
 </dd>
 </dl>
@@ -34782,15 +34831,23 @@ client.users.authentication_methods.create(
 <dl>
 <dd>
 
-**key_id:** `typing.Optional[str]` — Applies to webauthn authentication methods only. The id of the credential.
+**key_id:** `typing.Optional[str]` — Applies to webauthn/passkey authentication methods only. The id of the credential.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**public_key:** `typing.Optional[str]` — Applies to webauthn/passkey authentication methods only. The public key, which is encoded as base64.
 
 </dd>
 </dl>
 
 <dl>
 <dd>
 
-**public_key:** `typing.Optional[str]` — Applies to webauthn authentication methods only. The public key, which is encoded as base64.
+**aaguid:** `typing.Optional[str]` — Applies to passkeys only. Authenticator Attestation Globally Unique Identifier
 
 </dd>
 </dl>
@@ -34806,6 +34863,54 @@ client.users.authentication_methods.create(
 <dl>
 <dd>
 
+**credential_device_type:** `typing.Optional[CredentialDeviceTypeEnum]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**credential_backed_up:** `typing.Optional[bool]` — Applies to passkeys only. Whether the credential was backed up.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**identity_user_id:** `typing.Optional[str]` — Applies to passkeys only. The ID of the user identity linked with the authentication method.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**user_agent:** `typing.Optional[str]` — Applies to passkeys only. The user-agent of the browser used to create the passkey.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**user_handle:** `typing.Optional[str]` — Applies to passkeys only. The user handle of the user identity.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**transports:** `typing.Optional[typing.List[str]]` — Applies to passkeys only. The transports used by clients to communicate with the authenticator.
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>