fix(onesignal_rest_api): migrate to V2 org token auth and new API base URL

[sergio-eliot-rodriguez]

Summary

Fixes #20982 — OneSignal is deprecating V1 User Tokens on 2026-06-15.

• Base URL: https://onesignal.com/api/v1 → https://api.onesignal.com
• Authorization header: Basic <token> → Key <token> (V2 Organization Token)
• app_id placement: moved from request body (data) to query params (params)

All four action components (add-device, create-notification, get-device, get-devices) delegate to the centralized _makeRequest method in the app file, so they require no changes.

Test plan

• Connect a OneSignal account using a V2 Organization API Key
• Run get-devices — verify it returns the player list without auth errors
• Run get-device — verify a specific device is returned
• Run create-notification — verify a notification is created successfully
• Run add-device — verify a new device is registered

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Switched OneSignal integration to the current API endpoint, updated authorization header scheme to use "Key", and send app_id as a query parameter — improving push notification reliability.

• Chores

  • Bumped component and action package versions for the OneSignal integration.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
pipedream-docs-redirect-do-not-edit	Ignored		Jun 5, 2026 5:14pm

[pipedream-component-development]

Thank you so much for submitting this! We've added it to our backlog to review, and our team has been notified.

[pipedream-component-development]

Thanks for submitting this PR! When we review PRs, we follow the Pipedream component guidelines. If you're not familiar, here's a quick checklist:

• Create components to address specific use cases whenever possible
• Component keys should follow the format app_name_slug-slugified-component-name
• Components should follow the standard directory structure
• Prefer Node.js client libraries to REST APIs
• When making API requests, handle pagination to ensure all data / events are processed
• Use secret props to capture sensitive data
• Props and methods should be defined in app files whenever possible
• Document methods with JS Docs
• Use optional props whenever possible, and set a default value where you can
• Use async options to accept user input wherever possible

[coderabbitai]

📝 Walkthrough

Walkthrough

The OneSignal REST API integration now targets https://api.onesignal.com, uses Authorization: Key <rest_api_key>, and sends app_id as a query parameter; several action version fields and the package version were incremented.

Changes

OneSignal REST API Migration

Layer / File(s)	Summary
API endpoint and request construction components/onesignal_rest_api/onesignal_rest_api.app.mjs	_apiUrl() returns https://api.onesignal.com. _makeRequest() sets Authorization: Key <rest_api_key>, places app_id in params, and leaves request body as options.data.
Action metadata and package bump components/onesignal_rest_api/actions/add-device/add-device.mjs, components/onesignal_rest_api/actions/create-notification/create-notification.mjs, components/onesignal_rest_api/actions/get-device/get-device.mjs, components/onesignal_rest_api/actions/get-devices/get-devices.mjs, components/onesignal_rest_api/package.json	Bumped action version fields and incremented package version from 0.0.3 to 0.0.4. No behavioral changes in actions.

Sequence Diagram

sequenceDiagram
  participant Client
  participant OneSignalRESTSDK
  participant OneSignalAPI as api.onesignal.com
  Client->>OneSignalRESTSDK: invoke action (e.g. createNotification)
  OneSignalRESTSDK->>OneSignalAPI: HTTP request (Authorization: Key <rest_api_key>, params: app_id, body: options.data)
  OneSignalAPI-->>OneSignalRESTSDK: HTTP response
  OneSignalRESTSDK-->>Client: return response

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Suggested labels

HIGH PRIORITY

Suggested reviewers

• michelle0927
• mariano-pd

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main changes: migration to V2 org token auth and new API base URL.
Description check	✅ Passed	The description covers the summary of changes, references the linked issue, and includes a comprehensive test plan.
Linked Issues check	✅ Passed	The PR addresses issue #20982 by updating the base URL, changing authorization header scheme from Basic to Key for V2 tokens, and moving app_id to query parameters.
Out of Scope Changes check	✅ Passed	All changes are directly related to the OneSignal V2 auth migration objective; version bumps for components and package.json are standard practice.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[michelle0927]

@sergio-eliot-rodriguez This is failing checks. You need to update the package.json version and the component versions.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@components/onesignal_rest_api/actions/get-devices/get-devices.mjs`:
- Line 8: The action version in get-devices.mjs (and the other three actions
add-device, create-notification, get-device) must be changed from the MINOR bump
to a PATCH to match the package bump; update the version field in each action
file to the same PATCH version as the package (make the actions' version value
equal to the package's 0.0.4 PATCH) so component-level semver aligns with the
package instead of using 0.1.0; ensure you modify the top-level "version" string
in each action (e.g., in get-devices.mjs) accordingly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: e0890435-fe0b-4e14-a70c-382b011ef7c8

📥 Commits

Reviewing files that changed from the base of the PR and between 8a6fc1f and 796d4f9.

📒 Files selected for processing (4)

• components/onesignal_rest_api/actions/add-device/add-device.mjs
• components/onesignal_rest_api/actions/create-notification/create-notification.mjs
• components/onesignal_rest_api/actions/get-device/get-device.mjs
• components/onesignal_rest_api/actions/get-devices/get-devices.mjs

[michelle0927]

LGTM, Ready for QA