release: 9.0.0

.github/workflows/ci.yml

@@ -57,7 +57,7 @@ jobs:
       - name: Get GitHub OIDC Token
         if: github.repository == 'stainless-sdks/finch-typescript'
         id: github-oidc
-        uses: actions/github-script@v6
+        uses: actions/github-script@v8
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 

.github/workflows/release-doctor.yml

@@ -19,4 +19,3 @@ jobs:
           bash ./bin/check-release-environment
         env:
           NPM_TOKEN: ${{ secrets.FINCH_NPM_TOKEN || secrets.NPM_TOKEN }}
-

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "8.2.1"
+  ".": "9.0.0"
 }

.stats.yml

@@ -1,4 +1,4 @@
 configured_endpoints: 46
 openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/finch%2Ffinch-46f433f34d440aa1dfcc48cc8d822c598571b68be2f723ec99e1b4fba6c13b1e.yml
 openapi_spec_hash: 5b5cd728776723ac773900f7e8a32c05
-config_hash: 0892e2e0eeb0343a022afa62e9080dd1
+config_hash: ccdf6a5b4aaa2a0897c89ac8685d8eb0

CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 9.0.0 (2026-01-27)
+
+Full Changelog: [v8.2.1...v9.0.0](https://github.com/Finch-API/finch-api-node/compare/v8.2.1...v9.0.0)
+
+### Features
+
+* **api:** add per endpoint security ([94b79a2](https://github.com/Finch-API/finch-api-node/commit/94b79a26ed4c2cf31656a2d086fbaa07eea665f9))
+
+
+### Bug Fixes
+
+* **tests:** skip broken date validation test ([bd1b3dc](https://github.com/Finch-API/finch-api-node/commit/bd1b3dce0aa126ce871b590a38ceb88484205bf9))
+
+
+### Chores
+
+* **ci:** upgrade `actions/github-script` ([3e7b8f0](https://github.com/Finch-API/finch-api-node/commit/3e7b8f0f4f176fb1a049826c6b54db144e1bf1c7))
+* **internal:** codegen related update ([60b9d57](https://github.com/Finch-API/finch-api-node/commit/60b9d57de7446a9b007aec3494e3558ce7d09bb7))
+* **internal:** update lock file ([fbf54dd](https://github.com/Finch-API/finch-api-node/commit/fbf54dd83c73c8e44fefb0282dd54d96b2f647f9))
+
 ## 8.2.1 (2026-01-20)
 
 Full Changelog: [v8.2.0...v8.2.1](https://github.com/Finch-API/finch-api-node/compare/v8.2.0...v8.2.1)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryfinch/finch-api",
-  "version": "8.2.1",
+  "version": "9.0.0",
   "description": "The official TypeScript library for the Finch API",
   "author": "Finch <founders@tryfinch.com>",
   "types": "dist/index.d.ts",

packages/mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tryfinch/finch-api-mcp",
-  "version": "8.2.1",
+  "version": "9.0.0",
   "description": "The official MCP Server for the Finch API",
   "author": "Finch <founders@tryfinch.com>",
   "types": "dist/index.d.ts",

packages/mcp-server/src/server.ts

@@ -21,7 +21,7 @@ export const newMcpServer = () =>
   new McpServer(
     {
       name: 'tryfinch_finch_api_api',
-      version: '8.2.1',
+      version: '9.0.0',
     },
     { capabilities: { tools: {}, logging: {} } },
   );

packages/mcp-server/yarn.lock

@@ -3302,9 +3302,6 @@ readable-stream@^3.4.0:
     string_decoder "^1.1.1"
     util-deprecate "^1.0.1"
 
-"replicate@file:../../dist":
-  version "2.0.0-alpha.74"
-
 require-directory@^2.1.1:
   version "2.1.1"
   resolved "https://registry.yarnpkg.com/require-directory/-/require-directory-2.1.1.tgz#8c64ad5fd30dab1c976e2344ffe7f792a6a6df42"

src/client.ts

@@ -302,8 +302,14 @@ export class Finch {
     );
   }
 
-  protected async authHeaders(opts: FinalRequestOptions): Promise<NullableHeaders | undefined> {
-    return buildHeaders([await this.bearerAuth(opts), await this.basicAuth(opts)]);
+  protected async authHeaders(
+    opts: FinalRequestOptions,
+    schemes: { bearerAuth?: boolean; basicAuth?: boolean },
+  ): Promise<NullableHeaders | undefined> {
+    return buildHeaders([
+      schemes.bearerAuth ? await this.bearerAuth(opts) : null,
+      schemes.basicAuth ? await this.basicAuth(opts) : null,
+    ]);
   }
 
   protected async bearerAuth(opts: FinalRequestOptions): Promise<NullableHeaders | undefined> {
@@ -768,7 +774,7 @@ export class Finch {
         ...getPlatformHeaders(),
         'Finch-API-Version': '2020-09-17',
       },
-      await this.authHeaders(options),
+      await this.authHeaders(options, options.__security ?? { bearerAuth: true, basicAuth: true }),
       this._options.defaultHeaders,
       bodyHeaders,
       options.headers,

src/internal/request-options.ts

@@ -75,6 +75,8 @@ export type RequestOptions = {
    */
   defaultBaseURL?: string | undefined;
 
+  __security?: { bearerAuth?: boolean; basicAuth?: boolean };
+
   __binaryResponse?: boolean | undefined;
 };
 

src/resources/access-tokens.ts

@@ -32,6 +32,7 @@ export class AccessTokens extends APIResource {
       body: bodyWithReplacements,
       ...options,
       headers: headersWithReplacements,
+      __security: {},
     });
   }
 }

src/resources/account.ts

@@ -10,14 +10,14 @@ export class Account extends APIResource {
    * Disconnect one or more `access_token`s from your application.
    */
   disconnect(options?: RequestOptions): APIPromise<DisconnectResponse> {
-    return this._client.post('/disconnect', options);
+    return this._client.post('/disconnect', { ...options, __security: { bearerAuth: true } });
   }
 
   /**
    * Read account information associated with an `access_token`
    */
   introspect(options?: RequestOptions): APIPromise<Introspection> {
-    return this._client.get('/introspect', options);
+    return this._client.get('/introspect', { ...options, __security: { bearerAuth: true } });
   }
 }
 

src/resources/connect/sessions.ts

@@ -9,7 +9,7 @@ export class Sessions extends APIResource {
    * Create a new connect session for an employer
    */
   new(body: SessionNewParams, options?: RequestOptions): APIPromise<SessionNewResponse> {
-    return this._client.post('/connect/sessions', { body, ...options });
+    return this._client.post('/connect/sessions', { body, ...options, __security: { basicAuth: true } });
   }
 
   /**
@@ -19,7 +19,11 @@ export class Sessions extends APIResource {
     body: SessionReauthenticateParams,
     options?: RequestOptions,
   ): APIPromise<SessionReauthenticateResponse> {
-    return this._client.post('/connect/sessions/reauthenticate', { body, ...options });
+    return this._client.post('/connect/sessions/reauthenticate', {
+      body,
+      ...options,
+      __security: { basicAuth: true },
+    });
   }
 }
 

src/resources/hris/benefits/benefits.ts

@@ -38,7 +38,12 @@ export class Benefits extends APIResource {
     options?: RequestOptions,
   ): APIPromise<CreateCompanyBenefitsResponse> {
     const { entity_ids, ...body } = params ?? {};
-    return this._client.post('/employer/benefits', { query: { entity_ids }, body, ...options });
+    return this._client.post('/employer/benefits', {
+      query: { entity_ids },
+      body,
+      ...options,
+      __security: { bearerAuth: true },
+    });
   }
 
   /**
@@ -56,7 +61,11 @@ export class Benefits extends APIResource {
     query: BenefitRetrieveParams | null | undefined = {},
     options?: RequestOptions,
   ): APIPromise<CompanyBenefit> {
-    return this._client.get(path`/employer/benefits/${benefitID}`, { query, ...options });
+    return this._client.get(path`/employer/benefits/${benefitID}`, {
+      query,
+      ...options,
+      __security: { bearerAuth: true },
+    });
   }
 
   /**
@@ -78,6 +87,7 @@ export class Benefits extends APIResource {
       query: { entity_ids },
       body,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 
@@ -96,7 +106,11 @@ export class Benefits extends APIResource {
     query: BenefitListParams | null | undefined = {},
     options?: RequestOptions,
   ): PagePromise<CompanyBenefitsSinglePage, CompanyBenefit> {
-    return this._client.getAPIList('/employer/benefits', SinglePage<CompanyBenefit>, { query, ...options });
+    return this._client.getAPIList('/employer/benefits', SinglePage<CompanyBenefit>, {
+      query,
+      ...options,
+      __security: { bearerAuth: true },
+    });
   }
 
   /**
@@ -117,6 +131,7 @@ export class Benefits extends APIResource {
     return this._client.getAPIList('/employer/benefits/meta', SinglePage<SupportedBenefit>, {
       query,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 }

src/resources/hris/benefits/individuals.ts

@@ -31,6 +31,7 @@ export class Individuals extends APIResource {
       query: { entity_ids },
       body: individuals,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 
@@ -50,7 +51,11 @@ export class Individuals extends APIResource {
     query: IndividualEnrolledIDsParams | null | undefined = {},
     options?: RequestOptions,
   ): APIPromise<IndividualEnrolledIDsResponse> {
-    return this._client.get(path`/employer/benefits/${benefitID}/enrolled`, { query, ...options });
+    return this._client.get(path`/employer/benefits/${benefitID}/enrolled`, {
+      query,
+      ...options,
+      __security: { bearerAuth: true },
+    });
   }
 
   /**
@@ -74,7 +79,7 @@ export class Individuals extends APIResource {
     return this._client.getAPIList(
       path`/employer/benefits/${benefitID}/individuals`,
       SinglePage<IndividualBenefit>,
-      { query, ...options },
+      { query, ...options, __security: { bearerAuth: true } },
     );
   }
 
@@ -99,6 +104,7 @@ export class Individuals extends APIResource {
       query: { entity_ids },
       body,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 }

src/resources/hris/company/company.ts

@@ -29,7 +29,7 @@ export class CompanyResource extends APIResource {
     query: CompanyRetrieveParams | null | undefined = {},
     options?: RequestOptions,
   ): APIPromise<Company> {
-    return this._client.get('/employer/company', { query, ...options });
+    return this._client.get('/employer/company', { query, ...options, __security: { bearerAuth: true } });
   }
 }
 

src/resources/hris/company/pay-statement-item/pay-statement-item.ts

@@ -39,7 +39,7 @@ export class PayStatementItem extends APIResource {
     return this._client.getAPIList(
       '/employer/pay-statement-item',
       ResponsesPage<PayStatementItemListResponse>,
-      { query, ...options },
+      { query, ...options, __security: { bearerAuth: true } },
     );
   }
 }

src/resources/hris/company/pay-statement-item/rules.ts

@@ -28,6 +28,7 @@ export class Rules extends APIResource {
       query: { entity_ids },
       body,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 
@@ -52,6 +53,7 @@ export class Rules extends APIResource {
       query: { entity_ids },
       body,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 
@@ -73,6 +75,7 @@ export class Rules extends APIResource {
     return this._client.getAPIList('/employer/pay-statement-item/rule', ResponsesPage<RuleListResponse>, {
       query,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 
@@ -96,6 +99,7 @@ export class Rules extends APIResource {
     return this._client.delete(path`/employer/pay-statement-item/rule/${ruleID}`, {
       query: { entity_ids },
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 }

src/resources/hris/directory.ts

@@ -23,6 +23,7 @@ export class Directory extends APIResource {
     return this._client.getAPIList('/employer/directory', IndividualsPage, {
       query,
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 
@@ -98,11 +99,21 @@ export interface DirectoryListParams extends IndividualsPageParams {
   entity_ids?: Array<string>;
 }
 
-export interface DirectoryListIndividualsParams extends IndividualsPageParams {
+export interface DirectoryListIndividualsParams {
   /**
    * The entity IDs to specify which entities' data to access.
    */
   entity_ids?: Array<string>;
+
+  /**
+   * Number of employees to return (defaults to all)
+   */
+  limit?: number;
+
+  /**
+   * Index to start from (defaults to 0)
+   */
+  offset?: number;
 }
 
 export declare namespace Directory {

src/resources/hris/documents.ts

@@ -20,7 +20,7 @@ export class Documents extends APIResource {
     query: DocumentListParams | null | undefined = {},
     options?: RequestOptions,
   ): APIPromise<DocumentListResponse> {
-    return this._client.get('/employer/documents', { query, ...options });
+    return this._client.get('/employer/documents', { query, ...options, __security: { bearerAuth: true } });
   }
 
   /**
@@ -39,7 +39,11 @@ export class Documents extends APIResource {
     query: DocumentRetreiveParams | null | undefined = {},
     options?: RequestOptions,
   ): APIPromise<DocumentRetreiveResponse> {
-    return this._client.get(path`/employer/documents/${documentID}`, { query, ...options });
+    return this._client.get(path`/employer/documents/${documentID}`, {
+      query,
+      ...options,
+      __security: { bearerAuth: true },
+    });
   }
 }
 

src/resources/hris/employments.ts

@@ -29,6 +29,7 @@ export class Employments extends APIResource {
       body,
       method: 'post',
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 }

src/resources/hris/individuals.ts

@@ -27,6 +27,7 @@ export class Individuals extends APIResource {
       body,
       method: 'post',
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 }

src/resources/hris/pay-statements.ts

@@ -39,6 +39,7 @@ export class PayStatements extends APIResource {
       body,
       method: 'post',
       ...options,
+      __security: { bearerAuth: true },
     });
   }
 }