@W-24145082 - docs: document WIF connection fields and bulk kwargs

[sushmasreedharan-tableau]

Motivation

Companion gh-pages docs PR for #1887 (@W-24145082 — WIF connection update support). That PR adds user-visible API surface that docs/api-ref.md doesn't currently cover.

What changes

All edits are confined to docs/api-ref.md.

• ConnectionItem attribute table — new rows for workgroup_auth_mode and auth_federation_service_account, naming the ConnectionItem.WorkgroupAuthMode nested value set and its two string values (WIF = "workload-identity-federation", WIF_IMPERSONATION = "workload-identity-federation-impersonation").
• datasources.update_connection — adds a "How-to: convert an existing connection to Workload Identity Federation (WIF)" section mirroring the existing Snowflake keypair how-to, with direct (Snowflake) and impersonation (Google BigQuery) examples plus the server-enforced usage rules.
• datasources.update_connections (bulk) — updated signature line, new workgroup_auth_mode and auth_federation_service_account parameter rows, a version note that these parameters require REST API 3.30+, and a WIF (impersonation) example.
• flows.update_connection — short note that WIF fields reach the request payload via the shared Connection.update_req builder, with the caveat that server-side handling of WIF on flow connections is governed by the flow endpoint and may differ from workbook and datasource behavior.
• workbooks.update_connection — WIF how-to mirroring the datasource section.
• workbooks.update_connections (bulk) — updated signature line, new parameter rows, version note, and a WIF (direct) example.

Usage rules documented verbatim from the companion PR body and CHANGELOG:

• Resend workgroup_auth_mode on every subsequent update of a WIF connection; omitting it on a later update returns HTTP 400.
• Leave auth_type unset or "oauth" when sending a WIF mode; the server derives the stored auth type from the mode.
• Set auth_federation_service_account only with WorkgroupAuthMode.WIF_IMPERSONATION.
• The server does not echo workgroupAuthMode or authFederationServiceAccount on connections-GET responses today, so parsed values are typically None even when the connection is WIF-configured.

Requires REST API 3.30+ (Tableau Server release 26.3) with WIF configured and enabled on the site. Older servers silently ignore unknown connection attributes.

Non-changes

• No changes outside docs/api-ref.md.
• Does not touch or consolidate the existing duplicate datasources.update_connection section earlier in the file (that's a separate cleanup, out of scope for this doc update).

🤖 Generated with Claude Code