feat: add update_default_roles method to Tenant management

descope/management/common.py

@@ -96,6 +96,7 @@ class MgmtV1:
     tenant_settings_path = "/v1/mgmt/tenant/settings"
     tenant_load_all_path = "/v1/mgmt/tenant/all"
     tenant_search_all_path = "/v1/mgmt/tenant/search"
+    tenant_update_default_roles_path = "/v1/mgmt/tenant/updateDefaultRoles"
 
     # sso application
     sso_application_oidc_create_path = "/v1/mgmt/sso/idp/app/oidc/create"

descope/management/tenant.py

@@ -186,6 +186,26 @@ def update_settings(
 
         self._http.post(MgmtV1.tenant_settings_path, body=body, params=None)
 
+    def update_default_roles(
+        self,
+        tenant_id: str,
+        role_names: List[str],
+    ) -> None:
+        """
+        Set which project default roles apply to new users in this tenant.
+
+        Args:
+        tenant_id (str): The ID of the tenant to update.
+        role_names (List[str]): List of role names to set as tenant default roles.
+
+        Raise:
+        AuthException: raised if update operation fails
+        """
+        self._http.post(
+            MgmtV1.tenant_update_default_roles_path,
+            body={"id": tenant_id, "defaultRoles": role_names},
+        )
+
     def delete(
         self,
         id: str,

tests/management/test_tenant.py

@@ -525,6 +525,44 @@ def test_load_settings(self):
                 timeout=DEFAULT_TIMEOUT_SECONDS,
             )
 
+    def test_update_default_roles(self):
+        client = DescopeClient(
+            self.dummy_project_id,
+            self.public_key_dict,
+            False,
+            self.dummy_management_key,
+        )
+
+        # Test failed flows
+        with patch("requests.post") as mock_post:
+            mock_post.return_value.ok = False
+            self.assertRaises(
+                AuthException,
+                client.mgmt.tenant.update_default_roles,
+                "valid-id",
+                ["role1"],
+            )
+
+        # Test success flow
+        with patch("requests.post") as mock_post:
+            mock_post.return_value.ok = True
+            self.assertIsNone(
+                client.mgmt.tenant.update_default_roles("t1", ["role1", "role2"])
+            )
+            mock_post.assert_called_with(
+                f"{common.DEFAULT_BASE_URL}{MgmtV1.tenant_update_default_roles_path}",
+                headers={
+                    **common.default_headers,
+                    "Authorization": f"Bearer {self.dummy_project_id}:{self.dummy_management_key}",
+                    "x-descope-project-id": self.dummy_project_id,
+                },
+                params=None,
+                json={"id": "t1", "defaultRoles": ["role1", "role2"]},
+                allow_redirects=False,
+                verify=True,
+                timeout=DEFAULT_TIMEOUT_SECONDS,
+            )
+
         # Test success flow with SSO Setup Suite settings
         with patch("requests.get") as mock_get:
             network_resp = mock.Mock()