feat(api): add generic workos api gateway

package.json

@@ -49,20 +49,21 @@
     "@anthropic-ai/sdk": "^0.78.0",
     "@clack/core": "^1.0.1",
     "@clack/prompts": "1.0.1",
+    "@hono/node-server": "^1",
     "@napi-rs/keyring": "^1.2.0",
     "@workos-inc/node": "^8.7.0",
+    "@workos/openapi-spec": "^0.1.0",
     "@workos/skills": "0.5.0",
     "chalk": "^5.6.2",
     "diff": "^8.0.3",
     "fast-glob": "^3.3.3",
+    "hono": "^4",
     "ink": "^6.8.0",
     "opn": "^5.4.0",
     "react": "^19.2.4",
     "semver": "^7.7.4",
     "uuid": "^13.0.0",
     "xstate": "^5.28.0",
-    "hono": "^4",
-    "@hono/node-server": "^1",
     "yaml": "^2.8.2",
     "yargs": "^18.0.0",
     "zod": "^4.3.6"

src/bin.ts

@@ -430,6 +430,88 @@ yargs(rawArgs)
     );
     return yargs.demandCommand(1, 'Please specify an env subcommand').strict();
   })
+  .command(
+    'api [endpoint] [filter]',
+    'Make authenticated requests to the WorkOS API',
+    (yargs) =>
+      yargs
+        .options(insecureStorageOption)
+        .positional('endpoint', {
+          type: 'string',
+          describe: "API endpoint path (e.g. /users), or 'ls' to list endpoints",
+        })
+        .positional('filter', {
+          type: 'string',
+          describe: 'Filter keyword (used with ls)',
+        })
+        .option('method', {
+          alias: 'X',
+          type: 'string',
+          describe: 'HTTP method (default: GET, or POST if body provided)',
+        })
+        .option('data', {
+          alias: 'd',
+          type: 'string',
+          describe: 'JSON request body',
+        })
+        .option('file', {
+          type: 'string',
+          describe: 'Read request body from a file (or - for stdin)',
+        })
+        .option('include', {
+          alias: 'i',
+          type: 'boolean',
+          default: false,
+          describe: 'Show response headers',
+        })
+        .option('api-key', {
+          type: 'string',
+          describe: 'Override the API key',
+        })
+        .option('dry-run', {
+          type: 'boolean',
+          default: false,
+          describe: 'Show the request without executing it',
+        })
+        .option('yes', {
+          alias: 'y',
+          type: 'boolean',
+          default: false,
+          describe: 'Skip confirmation for mutating requests',
+        })
+        .example('workos api ls', 'List all available endpoints')
+        .example('workos api ls users', 'List endpoints matching "users"')
+        .example('workos api /user_management/users', 'GET /user_management/users')
+        .example('workos api /organizations -d \'{"name":"Acme"}\'', 'POST with a JSON body')
+        .example('workos api /organizations/org_123 -X DELETE', 'DELETE an organization'),
+    async (argv) => {
+      await applyInsecureStorage(argv.insecureStorage as boolean | undefined);
+      const endpoint = argv.endpoint as string | undefined;
+      const filter = argv.filter as string | undefined;
+
+      const { runApiLs, runApiRequest, runApiInteractive } = await import('./commands/api/index.js');
+
+      if (!endpoint) {
+        await runApiInteractive({ apiKey: argv.apiKey as string | undefined });
+        return;
+      }
+
+      if (endpoint === 'ls') {
+        await runApiLs(filter);
+        return;
+      }
+
+      await runApiRequest(endpoint, {
+        method: argv.method,
+        data: argv.data,
+        file: argv.file,
+        include: argv.include,
+        apiKey: argv.apiKey,
+        dryRun: argv.dryRun,
+        yes: argv.yes,
+      });
+    },
+  )
   .command(['organization', 'org'], 'Manage WorkOS organizations (create, update, get, list, delete)', (yargs) => {
     yargs.options({
       ...insecureStorageOption,