> **Building with AI coding agents?** Install the authstack plugin with one command. This equips your agent with accurate Scalekit implementation patterns. > > **Recommended** (the `-y` flags skip prompts, so the command runs without an interactive terminal): > ```bash > npx -y @scalekit-inc/cli setup -y > ``` > > Global: > ```bash > npm install -g @scalekit-inc/cli > scalekit setup -y > ``` > > Supports Claude Code, Cursor, GitHub Copilot, Codex + skills for other Agent Skills-compatible agents in `~/.agents/skills`. > Skills: integrate-agentkit, implement-saaskit, add-mcp-oauth, implement-sso, implement-scim. > [Full setup guide](https://docs.scalekit.com/dev-kit/build-with-ai/) --- # Connect AI agents to WorkOS The WorkOS connector lets your AI agent act in each user's WorkOS account. Each user connects their own WorkOS access token once, and Scalekit sends it with every call, so your agent never handles credentials. It comes with 73 tools. **Authentication:** Bearer Token **Categories:** Developer Tools **Tools:** 73: 40 read, 24 write, 9 destructive **Users sign in with:** Access token **Built by:** Scalekit connector **Try it:** [Playground in the Scalekit dashboard](https://app.scalekit.com/ws/signup?sk_intent=playground&provider=WORKOS) ## Setup 1. ### Install the SDK **Node.js** ```bash npm install @scalekit-sdk/node dotenv ``` **Python** ```bash pip install scalekit-sdk-python python-dotenv ``` 2. ### Set your credentials Add your Scalekit credentials to your `.env` file. Find values in **[app.scalekit.com](https://app.scalekit.com)** > **Developers** > **API Credentials**. ```sh title=".env" SCALEKIT_ENVIRONMENT_URL= SCALEKIT_CLIENT_ID= SCALEKIT_CLIENT_SECRET= ``` 3. ### Create the WorkOS connection In **AgentKit > Connections**, create a WorkOS connection. The name you give it is the `connection_name` your code passes. See [Configure connections](/agentkit/connections/). 4. ### Authorize a user and make your first call **Node.js** (`quickstart.mts`) ```typescript import { ScalekitClient } from '@scalekit-sdk/node' import 'dotenv/config' import { createInterface } from 'node:readline/promises' const scalekit = new ScalekitClient( process.env.SCALEKIT_ENVIRONMENT_URL, process.env.SCALEKIT_CLIENT_ID, process.env.SCALEKIT_CLIENT_SECRET, ) const actions = scalekit.actions const connector = 'workos' const identifier = 'user_123' // Generate an authorization link for the user const { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier }) console.log('Authorize WorkOS:', link) const rl = createInterface({ input: process.stdin, output: process.stdout }) await rl.question('Press Enter after authorizing...') rl.close() // Make your first call const result = await actions.executeTool({ connector, identifier, toolName: 'workos_audit_log_actions_list', toolInput: {}, }) console.log(result) ``` ```bash npx tsx quickstart.mts ``` **Python** (`quickstart.py`) ```python import os from scalekit import ScalekitClient from dotenv import load_dotenv load_dotenv() scalekit_client = ScalekitClient( env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"), client_id=os.getenv("SCALEKIT_CLIENT_ID"), client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"), ) actions = scalekit_client.actions connection_name = "workos" identifier = "user_123" # Generate an authorization link for the user link_response = actions.get_authorization_link( connection_name=connection_name, identifier=identifier, ) print("Authorize WorkOS:", link_response.link) input("Press Enter after authorizing...") # Make your first call result = actions.execute_tool( tool_input={}, tool_name="workos_audit_log_actions_list", connection_name=connection_name, identifier=identifier, ) print(result) ``` ```bash python quickstart.py ``` Each user opens the link once and enters their WorkOS credentials there. See [Authorize a user](/agentkit/tools/authorize/) for the full flow and statuses. ## Tools Pass the exact name to `execute_tool`, with an input like each tool's example. To ask for a tool that's missing, use the [request form](https://scalekitsupport.portal.usepylon.com/forms/request-a-connector-tool). **Node.js** ```typescript const result = await actions.executeTool({ toolName: 'workos_audit_log_actions_list', toolInput: {}, connector: 'workos', identifier: 'user_123', }) ``` **Python** ```python result = actions.execute_tool( tool_name="workos_audit_log_actions_list", tool_input={}, connection_name="workos", identifier="user_123", ) ``` `result.data` is the app's response as JSON, and `result.execution_id` (`executionId` in Node.js) is the ID of the call. ### `workos_audit_log_actions_list` List Audit Log Actions · Read-only List the audit log actions configured in the WorkOS environment. Returns a page of actions, each with its name and current schema, plus list_metadata cursors. Use this to see which action names workos_audit_log_event_create accepts; use workos_audit_log_schemas_list for one action's schema versions. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: user.signed_in - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: user.signed_in - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{}` ### `workos_audit_log_export_get` Get Audit Log Export · Read-only Get the status of an audit log export and, once ready, its download URL. Returns the export's state (pending, ready, or error) and url; the URL expires after 10 minutes, and fetching the export again issues a new one. Use this after workos_audit_log_export_create to wait for the export and download it. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `audit_log_export_id` (`string`, required): Unique ID of the audit log export. Get it from workos_audit_log_export_create. Example: audit_log_export_01GBZK5MP7TD1YCFQHFR22180V Example input: `{"audit_log_export_id":""}` ### `workos_audit_log_schemas_list` List Audit Log Schemas · Read-only List the schema versions of one audit log action. Returns a page of schemas with version, actor, targets, and metadata definitions. Use this to see what fields an action's events must carry; use workos_audit_log_actions_list to find action names. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `action_name` (`string`, required): Name of the audit log action. Get it from workos_audit_log_actions_list. Example: user.signed_in - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: audit_log_schema_01GBZK5MP7TD1YCFQHFR22180V - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: audit_log_schema_01GBZK5MP7TD1YCFQHFR22180V - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{"action_name":""}` ### `workos_connection_get` Get Connection · Read-only Get one SSO or OAuth connection by its ID. Returns the connection's name, connection_type, state (active, inactive, draft), organization_id, and domains. Use this to check whether a customer's SSO is active; use workos_connections_list to find connections by organization. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `connection_id` (`string`, required): Unique ID of the connection. Get it from workos_connections_list. Example: conn_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"connection_id":""}` ### `workos_connections_list` List Connections · Read-only List SSO and OAuth connections, optionally filtered by organization, type, domain, or a name search. Returns a page of connections (id, organization_id, connection_type, name, state, domains) plus list_metadata cursors. Use this to find an organization's SSO connection; use workos_connection_get when you have a connection ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: conn_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: conn_01E4ZCR3C56J083X43JQXF3JK5 - `connection_type` (`string`, optional): Return only connections of this type. Example: OktaSAML. One of: `ADFSSAML`, `AdpOidc`, `AppleOAuth`, `Auth0SAML`, `AzureSAML`, `BitbucketOAuth`, `CasSAML`, `CloudflareSAML`, `ClassLinkSAML`, `CleverOIDC`, `CyberArkSAML`, `DuoSAML`, `EntraIdOIDC`, `GenericOIDC`, `GenericSAML`, `GithubOAuth`, `GitLabOAuth`, `GoogleOAuth`, `GoogleOIDC`, `GoogleSAML`, `IntuitOAuth`, `JumpCloudSAML`, `KeycloakSAML`, `LastPassSAML`, `LinkedInOAuth`, `LoginGovOidc`, `MagicLink`, `MicrosoftOAuth`, `MiniOrangeSAML`, `NetIqSAML`, `OktaOIDC`, `OktaSAML`, `OneLoginSAML`, `OracleSAML`, `PingFederateSAML`, `PingOneSAML`, `RipplingSAML`, `SalesforceSAML`, `ShibbolethGenericSAML`, `ShibbolethSAML`, `SimpleSamlPhpSAML`, `SalesforceOAuth`, `SlackOAuth`, `VercelMarketplaceOAuth`, `VercelOAuth`, `VMwareSAML`, `XeroOAuth`. - `domain` (`string`, optional): Return connections associated with this domain. Example: foo-corp.com - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `organization_id` (`string`, optional): Return connections that belong to this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `search` (`string`, optional): Text to match against connection names. Example: Foo Corp Example input: `{}` ### `workos_directories_list` List Directories · Read-only List Directory Sync directories, optionally filtered by organization, domain, or a name search. Returns a page of directories (id, organization_id, name, type such as okta scim v2.0, state, domain) plus list_metadata cursors. Use this to find a customer's connected directory; use workos_directory_get when you have a directory ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: directory_01ECAZ4NV9QMV47GW873HDCX74 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: directory_01ECAZ4NV9QMV47GW873HDCX74 - `domain` (`string`, optional): Return directories associated with this domain. Example: foo-corp.com - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `organization_id` (`string`, optional): Return directories that belong to this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `search` (`string`, optional): Text to match against directory names. Example: Foo Corp Okta Example input: `{}` ### `workos_directory_get` Get Directory · Read-only Get one Directory Sync directory by its ID. Returns the directory's name, type, state, domain, organization_id, and user and group counts. Use this to check a directory's sync state; use workos_directories_list to find directories by organization. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `directory_id` (`string`, required): Unique ID of the directory. Get it from workos_directories_list. Example: directory_01ECAZ4NV9QMV47GW873HDCX74 Example input: `{"directory_id":""}` ### `workos_directory_group_get` Get Directory Group · Read-only Get one directory group synced from a customer's identity provider. Returns the group's name, idp_id, directory_id, organization_id, and raw_attributes. Use this when you have a directory_group_ ID; use workos_directory_groups_list to find groups in a directory. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `directory_group_id` (`string`, required): Unique ID of the directory group. Get it from workos_directory_groups_list. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z Example input: `{"directory_group_id":""}` ### `workos_directory_groups_list` List Directory Groups · Read-only List groups synced from a customer's directory, filtered by directory or by a directory user. Returns a page of directory groups (id, idp_id, directory_id, organization_id, name, raw_attributes) plus list_metadata cursors. Use this for groups provisioned from an identity provider; use workos_groups_list for groups you manage in WorkOS. Provide directory or user; get IDs from workos_directories_list or workos_directory_users_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z - `directory` (`string`, optional): ID of the directory to list groups from. Provide this or user. Example: directory_01ECAZ4NV9QMV47GW873HDCX74 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `user` (`string`, optional): ID of a directory user; returns only the groups that user belongs to. Provide this or directory. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ Example input: `{}` ### `workos_directory_user_get` Get Directory User · Read-only Get one directory user synced from a customer's identity provider. Returns the user's emails, names, job_title, username, state, role, groups, custom_attributes, and raw_attributes from the provider. Use this when you have a directory_user_ ID; use workos_directory_users_list to find users in a directory or group. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `directory_user_id` (`string`, required): Unique ID of the directory user. Get it from workos_directory_users_list. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ Example input: `{"directory_user_id":""}` ### `workos_directory_users_list` List Directory Users · Read-only List users synced from a customer's directory, filtered by directory or directory group. Returns a page of directory users (id, email, first_name, last_name, state, job_title, groups, custom_attributes, raw_attributes) plus list_metadata cursors. Use this for users provisioned from an identity provider; use workos_users_list for AuthKit users, or workos_directory_user_get for one directory user. Provide directory or group; get IDs from workos_directories_list or workos_directory_groups_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ - `directory` (`string`, optional): ID of the directory to list users from. Provide this or group. Example: directory_01ECAZ4NV9QMV47GW873HDCX74 - `email` (`string`, optional): Return the directory user with this primary email. Requires directory. Example: marcelina@foo-corp.com - `group` (`string`, optional): ID of a directory group; returns only users in that group. Provide this or directory. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z - `idp_id` (`string`, optional): Return the directory user with this identity-provider ID. Requires directory. Example: 2836 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{}` ### `workos_events_list` List Events · Read-only List events from the WorkOS environment's event stream, filtered by event type and optionally by organization or date range. Returns a page of events (id, event type, data payload, context, created_at) plus list_metadata cursors. Use this to see what changed recently, such as dsync.user.created or user.created; use the resource-specific list tools for current state. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `events` (`string`, required): Comma-separated event types to return (required by WorkOS). Example: dsync.user.created,dsync.user.updated,user.created - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: event_01H2GNQD5B3SV2V3Z8TKW0Y3TX - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: event_01H2GNQD5B3SV2V3Z8TKW0Y3TX - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `organization_id` (`string`, optional): Return only events for this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `range_end` (`string`, optional): Return events created before this ISO-8601 date-time. Example: 2025-01-31T23:59:59Z - `range_start` (`string`, optional): Return events created after this ISO-8601 date-time. Example: 2025-01-01T00:00:00Z Example input: `{"events":""}` ### `workos_feature_flag_get` Get Feature Flag · Read-only Get one feature flag by its slug. Returns the flag's name, description, enabled state, default_value, tags, and owner. Use this to check whether a flag is on in the environment; use workos_feature_flags_list to browse flags. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `flag_slug` (`string`, required): Slug of the feature flag. Get it from workos_feature_flags_list. Example: advanced-analytics Example input: `{"flag_slug":""}` ### `workos_feature_flags_list` List Feature Flags · Read-only List the feature flags defined in the WorkOS environment. Returns a page of flags (id, slug, name, description, enabled, default_value, tags, owner) plus list_metadata cursors. Use this to browse all flags; use workos_organization_feature_flags_list or workos_user_feature_flags_list to see flags enabled for one organization or user. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: flag_01HXYZ123456789ABCDEFGHIJ - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: flag_01HXYZ123456789ABCDEFGHIJ - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{}` ### `workos_group_get` Get Group · Read-only Get one group in an organization by its ID. Returns the group's name, description, organization_id, and timestamps. Use this when you have a group ID; use workos_groups_list to find groups in an organization. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"group_id":"","organization_id":""}` ### `workos_group_members_list` List Group Members · Read-only List the organization memberships that belong to one group. Returns a page of memberships (id, user_id, organization_id, status) plus list_metadata cursors. Use this to see who is in a group; use workos_organization_membership_groups_list for one member's groups. Requires organization and group IDs from workos_groups_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{"group_id":"","organization_id":""}` ### `workos_groups_list` List Groups · Read-only List the groups in one organization, optionally searching by name or group ID. Returns a page of groups (id, organization_id, name, description) plus list_metadata cursors. Use this for groups managed in WorkOS; use workos_directory_groups_list for groups synced from a customer's identity provider. Requires an organization ID from workos_organizations_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `search` (`string`, optional): Text to match against group names or group IDs. Example: Engineering Example input: `{"organization_id":""}` ### `workos_invitation_get` Get Invitation · Read-only Get one AuthKit invitation by its ID. Returns the invitation's email, state (pending, accepted, expired, or revoked), organization_id, role_slug, inviter_user_id, expires_at, and accept_invitation_url. Use this to check an invitation's status; use workos_invitations_list to find invitations by email or organization. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `invitation_id` (`string`, required): Unique ID of the invitation. Get it from workos_invitations_list. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"invitation_id":""}` ### `workos_invitations_list` List Invitations · Read-only List AuthKit invitations, optionally filtered by organization or recipient email. Returns a page of invitations (id, email, state, organization_id, role_slug, expires_at, accept_invitation_url) plus list_metadata cursors. Use this to find pending or past invitations; use workos_invitation_get when you have an invitation ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5 - `email` (`string`, optional): Return invitations sent to this email address. Example: marcelina@example.com - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `organization_id` (`string`, optional): Return invitations to this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{}` ### `workos_membership_role_assignments_list` List Membership Role Assignments · Read-only List the role assignments of one organization membership, across the organization and its sub-resources. Returns a page of role assignments (id, role slug, resource, source) plus list_metadata cursors. Use this to see every role a member holds and on which resource; use workos_organization_membership_get for the member's organization-level role. Requires a membership ID from workos_organization_memberships_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: role_assignment_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: role_assignment_01E4ZCR3C56J083X43JQXF3JK5 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `resource_external_id` (`string`, optional): Return only assignments on the resource with this external ID. Example: project-123 - `resource_id` (`string`, optional): Return only assignments on this resource ID. Example: authz_resource_01HXYZ123456789ABCDEFGHIJ - `resource_type_slug` (`string`, optional): Return only assignments on resources of this type. Example: project Example input: `{"organization_membership_id":""}` ### `workos_organization_domain_get` Get Organization Domain · Read-only Get one organization domain by its ID. Returns the domain, its state (pending, verified, failed), verification_strategy, verification_prefix, verification_token, and organization_id. Use this to check a domain's verification state or read the DNS values to publish; use workos_organization_get to see all of an organization's domains. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_domain_id` (`string`, required): Unique ID of the organization domain. Get it from workos_organization_get (domains[].id). Example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A Example input: `{"organization_domain_id":""}` ### `workos_organization_feature_flags_list` List Organization Feature Flags · Read-only List the feature flags enabled for one organization. Returns a page of enabled flags (slug, name, enabled, default_value, tags) plus list_metadata cursors. Use this to see what an organization has turned on; use workos_user_feature_flags_list for one user, or workos_feature_flags_list for every flag. Requires an organization ID from workos_organizations_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: flag_01HXYZ123456789ABCDEFGHIJ - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: flag_01HXYZ123456789ABCDEFGHIJ - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to desc. Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{"organization_id":""}` ### `workos_organization_get` Get Organization · Read-only Get one WorkOS organization by its WorkOS ID. Returns the organization's name, domains with verification state, external_id, metadata, stripe_customer_id, and timestamps. Use this when you have the org_ ID; use workos_organization_get_by_external_id for your own app's ID, or workos_organizations_list to search. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"organization_id":""}` ### `workos_organization_get_by_external_id` Get Organization by External ID · Read-only Get one WorkOS organization by the external ID your application assigned to it. Returns the organization's id, name, domains, external_id, metadata, and timestamps. Use this when you know your own system's ID for the organization; use workos_organization_get when you have the WorkOS org_ ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `external_id` (`string`, required): The external ID your application set on the organization when creating or updating it. Example: 2fe01467-f7ea-4dd2-8b79-c2b4f56d0191 Example input: `{"external_id":""}` ### `workos_organization_membership_get` Get Organization Membership · Read-only Get one organization membership by its ID. Returns the membership's user_id, organization_id, status, role, roles, directory_managed flag, and the embedded user. Use this when you have an om_ ID; use workos_organization_memberships_list to find memberships by user or organization. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"organization_membership_id":""}` ### `workos_organization_membership_groups_list` List Organization Membership Groups · Read-only List the groups that one organization membership belongs to. Returns a page of groups (id, organization_id, name, description) plus list_metadata cursors. Use this to see a member's groups; use workos_group_members_list for the members of one group. Requires a membership ID from workos_organization_memberships_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{"organization_membership_id":""}` ### `workos_organization_memberships_list` List Organization Memberships · Read-only List organization memberships for a user, an organization, or both, optionally filtered by status. Returns a page of memberships (id, user_id, organization_id, status, role, roles, organization_name) plus list_metadata cursors. Use this to see who belongs to an organization or which organizations a user belongs to; use workos_organization_membership_get for one membership. Provide at least one of organization_id or user_id. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `organization_id` (`string`, optional): Return memberships in this organization. Provide this, user_id, or both. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `statuses` (`string`, optional): Comma-separated membership statuses to include: active, inactive, pending. Only active memberships are returned when empty. Example: active,inactive - `user_id` (`string`, optional): Return memberships of this user. Provide this, organization_id, or both. Example: user_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{}` ### `workos_organization_role_get` Get Organization Role · Read-only Get one role that applies to an organization by its slug; it can be an environment role or a custom role. Returns the role's name, description, type, and permission slugs. Use this to inspect a role in an organization's context; use workos_role_get for an environment role. Requires an organization ID from workos_organizations_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `role_slug` (`string`, required): Slug of the role. Get it from workos_organization_roles_list. Example: org-billing-admin Example input: `{"organization_id":"","role_slug":""}` ### `workos_organization_roles_list` List Organization Roles · Read-only List every role that applies to one organization, including environment roles and the organization's custom roles, in priority order. Returns roles with slug, name, description, type (EnvironmentRole or OrganizationRole), and permission slugs. Use this to see which roles can be given to an organization's members; use workos_roles_list for environment roles only. Requires an organization ID from workos_organizations_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"organization_id":""}` ### `workos_organizations_list` List Organizations · Read-only List organizations in the WorkOS environment, optionally filtered by domain or a name search. Returns a page of organizations (id, name, domains, external_id, metadata, timestamps) plus list_metadata cursors. Use this to browse or find organizations; use workos_organization_get when you already have an organization ID, or workos_organization_get_by_external_id for your own app's ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `domains` (`string`, optional): Comma-separated list of domains. Returns organizations that own any of these domains. Example: foo-corp.com,bar.com - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `search` (`string`, optional): Text to match against organization names. Example: Foo Corp Example input: `{}` ### `workos_permission_get` Get Permission · Read-only Get one permission by its slug. Returns the permission's name, description, system flag, and resource_type_slug. Use this to look up a permission referenced by a role; use workos_permissions_list to browse. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `permission_slug` (`string`, required): Slug of the permission. Get it from workos_permissions_list. Example: posts:read Example input: `{"permission_slug":""}` ### `workos_permissions_list` List Permissions · Read-only List the permissions defined in the WorkOS environment. Returns a page of permissions (id, slug, name, description, system, resource_type_slug) plus list_metadata cursors. Use this to browse available permissions; use workos_permission_get for one permission by slug. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: perm_01HXYZ123456789ABCDEFGHIJ - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: perm_01HXYZ123456789ABCDEFGHIJ - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{}` ### `workos_role_get` Get Environment Role · Read-only Get one environment-level role by its slug. Returns the role's name, description, type, and permission slugs. Use this to inspect a role's permissions; use workos_organization_role_get for a role that may be custom to one organization. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `role_slug` (`string`, required): Slug of the environment role. Get it from workos_roles_list. Example: admin Example input: `{"role_slug":""}` ### `workos_roles_list` List Environment Roles · Read-only List the environment-level roles defined in WorkOS, in priority order. Returns roles with slug, name, description, type, and their permission slugs. Use this to see roles available to every organization; use workos_organization_roles_list to include an organization's custom roles. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: none. Example input: `{}` ### `workos_user_feature_flags_list` List User Feature Flags · Read-only List the feature flags enabled for one user, including flags enabled through the organizations they belong to. Returns a page of enabled flags (slug, name, enabled, default_value, tags) plus list_metadata cursors. Use this to see what a user has access to; use workos_organization_feature_flags_list for an organization. Requires a user ID from workos_users_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: flag_01HXYZ123456789ABCDEFGHIJ - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: flag_01HXYZ123456789ABCDEFGHIJ - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to desc. Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{"user_id":""}` ### `workos_user_get` Get User · Read-only Get one AuthKit user by WorkOS user ID. Returns the user's email, first and last name, email_verified, profile_picture_url, external_id, metadata, locale, and last_sign_in_at. Use this when you have the user_ ID; use workos_user_get_by_external_id for your own app's ID, or workos_users_list to search by email. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"user_id":""}` ### `workos_user_get_by_external_id` Get User by External ID · Read-only Get one AuthKit user by the external ID your application assigned to it. Returns the user's id, email, names, email_verified, external_id, metadata, and timestamps. Use this when you know your own system's ID for the user; use workos_user_get when you have the WorkOS user_ ID. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `external_id` (`string`, required): The external ID your application set on the user. Example: f1ffa2b2-c20b-4d39-be5c-212726e11222 Example input: `{"external_id":""}` ### `workos_user_identities_get` Get User Identities · Read-only Get the OAuth identities linked to one AuthKit user. Returns an array of identities, each with idp_id, type, and provider (for example GoogleOAuth or GitHubOAuth). Use this to see which social or OAuth providers a user signs in with; use workos_user_get for the user's profile. Requires a user ID from workos_users_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"user_id":""}` ### `workos_user_sessions_list` List User Sessions · Read-only List the active sessions of one AuthKit user. Returns a page of sessions (id, ip_address, user_agent, organization_id, auth_method, status, expires_at, impersonator) plus list_metadata cursors. Use this to audit where a user is signed in or to find a session ID for workos_session_revoke. Requires a user ID from workos_users_list. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: session_01H93ZY4F80QPBEZ1R5B2SHQG8 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: session_01H93ZY4F80QPBEZ1R5B2SHQG8 - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. Example input: `{"user_id":""}` ### `workos_users_list` List Users · Read-only List AuthKit users in the WorkOS environment, optionally filtered by organization or exact email. Returns a page of users (id, email, first_name, last_name, email_verified, external_id, last_sign_in_at) plus list_metadata cursors. Use this to browse or find users; use workos_user_get when you have a user ID, or workos_directory_users_list for users synced from a customer's directory. Read only: yes. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `after` (`string`, optional): Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `before` (`string`, optional): Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `email` (`string`, optional): Return only the user with this exact email address. Example: marcelina@example.com - `limit` (`integer`, optional): Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25. Default: `10`. - `order` (`string`, optional): Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: desc. One of: `normal`, `desc`, `asc`. - `organization_id` (`string`, optional): Return only users who are members of this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{}` ### `workos_audit_log_event_create` Create Audit Log Event · Write Record an audit log event for an organization. Returns success: true once the event is accepted. Use this to write an entry to a customer's audit log; use workos_audit_log_export_create to read events back out. Requires an organization ID; the action should match one from workos_audit_log_actions_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `event` (`object`, required): The audit log event. It needs an action name, the time it occurred (ISO-8601), the actor who did it (id and type, optionally name and metadata), the targets it affected (each with id and type), and a context with the request location (IP address) and optional user_agent. Optional metadata and schema version can be added. Example: {"action": "user.signed_in", "occurred_at": "2025-01-15T12:00:00Z", "actor": {"id": "user_01GBNJC3MX9ZZJW1FSTF4C5938", "type": "user"}, "targets": [{"id": "team_01GBNJD4MKHVKJGEWK42JNMBGS", "type": "team"}], "context": {"location": "123.123.123.123", "user_agent": "Chrome/104.0.0.0"}} - `organization_id` (`string`, required): ID of the organization the event belongs to. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"event":{},"organization_id":""}` ### `workos_audit_log_export_create` Create Audit Log Export · Write Start a CSV export of one organization's audit log events for a date range, optionally filtered by action, actor, or target. Returns the export with its ID and state (pending at first); the download url appears once it is ready. Use this to pull audit events out of WorkOS; then poll workos_audit_log_export_get until state is ready. Requires an organization ID from workos_organizations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `organization_id` (`string`, required): ID of the organization to export events for. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `range_end` (`string`, required): End of the export range as an ISO-8601 date-time. Example: 2025-01-31T23:59:59Z - `range_start` (`string`, required): Start of the export range as an ISO-8601 date-time. Example: 2025-01-01T00:00:00Z - `actions` (`array`, optional): Only export events with these action names. Example: ["user.signed_in"] - `actor_ids` (`array`, optional): Only export events by actors with these IDs. Example: ["user_01GBZK5MP7TD1YCFQHFR22180V"] - `actor_names` (`array`, optional): Only export events by actors with these names. Example: ["Jon Smith"] - `targets` (`array`, optional): Only export events that affected these target types. Example: ["team"] Example input: `{"organization_id":"","range_end":"","range_start":""}` ### `workos_authorization_check` Check Authorization · Write Check whether an organization membership has a permission on a resource. Returns authorized: true or false. Use this to answer can-this-user-do-X questions; use workos_membership_role_assignments_list to see why. Requires a membership ID from workos_organization_memberships_list and either resource_id or resource_external_id plus resource_type_slug. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `permission_slug` (`string`, required): Slug of the permission to check. Example: posts:edit - `resource_external_id` (`string`, optional): Your application's ID for the resource. Use together with resource_type_slug, instead of resource_id. Example: project-123 - `resource_id` (`string`, optional): ID of the authorization resource. Provide this, or resource_external_id together with resource_type_slug. Example: authz_resource_01HXYZ123456789ABCDEFGHIJ - `resource_type_slug` (`string`, optional): Slug of the resource type. Use together with resource_external_id. Example: project Example input: `{"organization_membership_id":"","permission_slug":""}` ### `workos_feature_flag_disable` Disable Feature Flag · Write Turn a feature flag off in the WorkOS environment. Returns the flag with enabled set to false. Use this to roll a feature back; use workos_feature_flag_enable to turn it on. Requires a flag slug from workos_feature_flags_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `flag_slug` (`string`, required): Slug of the feature flag. Get it from workos_feature_flags_list. Example: advanced-analytics Example input: `{"flag_slug":""}` ### `workos_feature_flag_enable` Enable Feature Flag · Write Turn a feature flag on in the WorkOS environment. Returns the flag with enabled set to true. Use this to roll a feature out; use workos_feature_flag_disable to turn it off. Requires a flag slug from workos_feature_flags_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `flag_slug` (`string`, required): Slug of the feature flag. Get it from workos_feature_flags_list. Example: advanced-analytics Example input: `{"flag_slug":""}` ### `workos_group_create` Create Group · Write Create a new group in an organization. Returns the created group with its ID, name, and description. Use this to organize organization members; then use workos_group_member_add to add members. Requires an organization ID from workos_organizations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `name` (`string`, required): Name of the group. Example: Engineering - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `description` (`string`, optional): Optional description of the group. Example: All engineering staff Example input: `{"name":"","organization_id":""}` ### `workos_group_member_add` Add Group Member · Write Add an organization membership to a group. Returns the group the member was added to. Use this to put a member into a group; use workos_group_member_remove to take them out. Requires a group ID from workos_groups_list and a membership ID from workos_organization_memberships_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `group_id` (`string`, required): Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `organization_membership_id` (`string`, required): ID of the organization membership to add to the group. Example: om_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"group_id":"","organization_id":"","organization_membership_id":""}` ### `workos_group_update` Update Group · Write Update a group's name or description; fields you leave out stay unchanged. Returns the updated group. Use this to rename a group or change its description; use workos_group_create for a new group. Requires organization and group IDs from workos_groups_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `group_id` (`string`, required): Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `description` (`string`, optional): New description for the group. Example: Platform and infrastructure engineers - `name` (`string`, optional): New name for the group. Example: Platform Engineering Example input: `{"group_id":"","organization_id":""}` ### `workos_invitation_resend` Resend Invitation · Write Send the invitation email again for a pending AuthKit invitation. Returns the invitation with its state and expires_at. Use this when the recipient lost or never got the email; use workos_invitation_send to invite someone new. Only pending invitations can be resent. Requires an invitation ID from workos_invitations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `invitation_id` (`string`, required): Unique ID of the pending invitation. Get it from workos_invitations_list. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5 - `locale` (`string`, optional): Language for the invitation email, as a locale code such as en, en-GB, fr, de, ja, or pt-BR. Defaults to the environment's locale. Example: en Example input: `{"invitation_id":""}` ### `workos_invitation_revoke` Revoke Invitation · Write Revoke an AuthKit invitation so it can no longer be accepted. Returns the invitation with state revoked and revoked_at set. Use this to cancel an invite sent by mistake; use workos_invitation_resend to send a pending invite again. Requires an invitation ID from workos_invitations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `invitation_id` (`string`, required): Unique ID of the invitation to revoke. Get it from workos_invitations_list. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"invitation_id":""}` ### `workos_invitation_send` Send Invitation · Write Create an AuthKit invitation and email it to the recipient, optionally into an organization with a role. Returns the invitation with its ID, state pending, expires_at, and accept_invitation_url. Use this to invite someone who does not have a user yet; use workos_organization_membership_create to add an existing user directly, or workos_invitation_resend to re-send a pending invite. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `email` (`string`, required): Email address of the person to invite. Example: marcelina@example.com - `expires_in_days` (`integer`, optional): Number of days the invitation stays valid, from 1 to 30. Defaults to 7. Example: 14 - `inviter_user_id` (`string`, optional): ID of the user sending the invitation; the email mentions this user's name. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `locale` (`string`, optional): Language for the invitation email, as a locale code such as en, en-GB, fr, de, ja, or pt-BR. Defaults to the environment's locale. Example: en - `organization_id` (`string`, optional): Organization the recipient will join when they accept. Leave empty for an environment-level invite. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `role_slug` (`string`, optional): Role the recipient gets when they join the organization. Only valid with organization_id. Example: admin Example input: `{"email":""}` ### `workos_membership_role_assign` Assign Role to Membership · Write Assign a role to an organization membership on a specific resource. Returns the new role assignment with its ID, role, resource, and source. Use this for resource-level roles in Fine-Grained Authorization; use workos_organization_membership_update to change the member's organization-wide role. Requires a membership ID from workos_organization_memberships_list and either resource_id or resource_external_id plus resource_type_slug. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `role_slug` (`string`, required): Slug of the role to assign. Example: editor - `resource_external_id` (`string`, optional): Your application's ID for the resource. Use together with resource_type_slug, instead of resource_id. Example: project-123 - `resource_id` (`string`, optional): ID of the authorization resource. Provide this, or resource_external_id together with resource_type_slug. Example: authz_resource_01HXYZ123456789ABCDEFGHIJ - `resource_type_slug` (`string`, optional): Slug of the resource type. Use together with resource_external_id. Example: project Example input: `{"organization_membership_id":"","role_slug":""}` ### `workos_organization_create` Create Organization · Write Create a new organization in the WorkOS environment. Returns the created organization with its new org_ ID, name, domains, external_id, and metadata. Use this to add a customer organization; use workos_organization_update to change an existing one. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `name` (`string`, required): Name of the organization. Example: Foo Corp - `allow_profiles_outside_organization` (`boolean`, optional): Whether users whose email domain is not one of the organization's domains may sign in through the organization's SSO connections. Example: false - `domain_data` (`array`, optional): Domains to attach to the organization, each with a domain and a verification state (pending or verified). Use verified only for domains you have already verified yourself. Example: [{"domain": "foo-corp.com", "state": "pending"}] - `external_id` (`string`, optional): Your application's own ID for this organization, so you can look it up later with workos_organization_get_by_external_id. Example: 2fe01467-f7ea-4dd2-8b79-c2b4f56d0191 - `metadata` (`object`, optional): Key/value pairs of string metadata to store on the organization. Example: {"tier": "enterprise"} Example input: `{"name":""}` ### `workos_organization_domain_create` Create Organization Domain · Write Add a domain to an organization; it starts in the pending state until verified. Returns the organization domain with its ID, state, verification_strategy, verification_prefix, and verification_token for the DNS record. Use this to claim a new domain for an organization; then use workos_organization_domain_verify after the DNS TXT record is in place. Requires an organization ID from workos_organizations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `domain` (`string`, required): Domain name to add. Example: foo-corp.com - `organization_id` (`string`, required): ID of the organization to add the domain to. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"domain":"","organization_id":""}` ### `workos_organization_domain_verify` Verify Organization Domain · Write Start the DNS verification check for a pending organization domain. Returns the organization domain with its updated state. Use this after the customer has published the DNS TXT record from workos_organization_domain_get or workos_organization_domain_create. Requires an organization domain ID. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `organization_domain_id` (`string`, required): Unique ID of the organization domain to verify. Get it from workos_organization_domain_create or workos_organization_get (domains[].id). Example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A Example input: `{"organization_domain_id":""}` ### `workos_organization_membership_create` Create Organization Membership · Write Add a user to an organization as an active member, optionally with specific roles. Returns the membership with its om_ ID, user_id, organization_id, status, and role. Use this to give an existing user access to an organization; it also reactivates an inactive membership. Use workos_invitation_send to invite someone who has no user yet. Requires a user ID from workos_users_list and an organization ID from workos_organizations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `organization_id` (`string`, required): ID of the organization to add the user to. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `user_id` (`string`, required): ID of the user to add. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `role_slug` (`string`, optional): Slug of a single role to give the member. Defaults to the environment's default role (usually member). Do not combine with role_slugs. Example: admin - `role_slugs` (`array`, optional): Several role slugs to give the member, when Multiple Roles is enabled for the environment. Do not combine with role_slug. Example: ["admin", "billing"] Example input: `{"organization_id":"","user_id":""}` ### `workos_organization_membership_deactivate` Deactivate Organization Membership · Write Deactivate an active organization membership so the user loses access but keeps their roles. Returns the membership with status inactive. Use this to suspend a member temporarily; use workos_organization_membership_reactivate to restore access, or workos_organization_membership_delete to remove it for good. Pending memberships cannot be deactivated. Requires a membership ID from workos_organization_memberships_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership to deactivate. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"organization_membership_id":""}` ### `workos_organization_membership_reactivate` Reactivate Organization Membership · Write Reactivate an inactive organization membership, keeping the roles it had before. Returns the membership with status active. Use this to restore access after workos_organization_membership_deactivate; use workos_organization_membership_create to add a user who has no membership. Requires a membership ID from workos_organization_memberships_list (pass statuses=inactive to find it). Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership to reactivate. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"organization_membership_id":""}` ### `workos_organization_membership_update` Update Organization Membership · Write Change the role or roles of an existing organization membership. Returns the updated membership with its status, role, and roles. Use this to promote or demote a member; use workos_organization_membership_deactivate to suspend access without changing roles. Requires a membership ID from workos_organization_memberships_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership to update. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `role_slug` (`string`, optional): Slug of the single role the member should have. Provide this or role_slugs. Example: admin - `role_slugs` (`array`, optional): Role slugs the member should have, when Multiple Roles is enabled. Provide this or role_slug. Example: ["admin", "billing"] Example input: `{"organization_membership_id":""}` ### `workos_organization_update` Update Organization · Write Update an existing WorkOS organization; fields you leave out stay unchanged. Returns the updated organization with its name, domains, external_id, metadata, and stripe_customer_id. Use this to rename an organization or change its domains, metadata, external ID, or Stripe customer ID; use workos_organization_create for a new one. Requires an organization ID from workos_organizations_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `allow_profiles_outside_organization` (`boolean`, optional): Whether users whose email domain is not one of the organization's domains may sign in through its SSO connections. Example: false - `domain_data` (`array`, optional): Replacement list of domains, each with a domain and a verification state (pending or verified). Example: [{"domain": "foo-corp.com", "state": "verified"}] - `external_id` (`string`, optional): Your application's own ID for this organization. Example: 2fe01467-f7ea-4dd2-8b79-c2b4f56d0191 - `metadata` (`object`, optional): Key/value pairs of string metadata to store on the organization. Example: {"tier": "enterprise"} - `name` (`string`, optional): New name for the organization. Example: Foo Corp - `stripe_customer_id` (`string`, optional): Stripe customer ID to associate with the organization. Example: cus_R9qWAGMQ6nGE7V Example input: `{"organization_id":""}` ### `workos_portal_link_generate` Generate Admin Portal Link · Write Generate a short-lived Admin Portal link that lets a customer's IT admin set up SSO, Directory Sync, domain verification, audit log streams, or certificate renewal for their organization. Returns link, a URL to send to the customer's IT admin. Use this when a customer needs to configure their own SSO or directory; use workos_connections_list or workos_directories_list to check the result afterwards. Requires an organization ID from workos_organizations_list. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `organization` (`string`, required): ID of the organization the Admin Portal link is for. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `external_user_id` (`string`, optional): ID of the user in your application the link is generated for, so the link and its sessions can be revoked later. Example: user_123 - `intent` (`string`, optional): Which Admin Portal flow to open: sso, dsync, audit_logs, log_streams, domain_verification, certificate_renewal, or bring_your_own_key. Example: sso. One of: `sso`, `dsync`, `audit_logs`, `log_streams`, `domain_verification`, `certificate_renewal`, `bring_your_own_key`. - `it_contact_emails` (`array`, optional): Email addresses of IT contacts to grant Admin Portal access for this organization, up to 20. Example: ["it-admin@foo-corp.com"] - `return_url` (`string`, optional): URL to send the admin to when they click your logo in the Admin Portal. Defaults to the URL set in the WorkOS dashboard. Example: https://example.com/settings - `success_url` (`string`, optional): URL to redirect the admin to after they finish setup. Defaults to the URL set in the WorkOS dashboard. Example: https://example.com/sso/success Example input: `{"organization":""}` ### `workos_session_revoke` Revoke Session · Write Revoke one AuthKit user session so it can no longer be used. Returns no content on success. Use this to sign a user out of a specific session; use workos_user_sessions_list first to find the session ID. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `session_id` (`string`, required): ID of the session to revoke, from workos_user_sessions_list or the sid claim of an access token. Example: session_01H93ZY4F80QPBEZ1R5B2SHQG8 Example input: `{"session_id":""}` ### `workos_user_create` Create User · Write Create a new AuthKit user in the WorkOS environment, optionally with a password. Returns the created user with its new user_ ID, email, names, email_verified, and external_id. Use this to add a user record directly; use workos_invitation_send to email someone an invite instead, and workos_organization_membership_create to add the user to an organization. Read only: no. Destructive: no. Idempotent (safe to retry): no. Inputs: - `email` (`string`, required): Email address of the user. WorkOS trims whitespace and lowercases it. Example: marcelina@example.com - `email_verified` (`boolean`, optional): Whether the user's email is already verified. Set true only if your application has verified it. Example: false - `external_id` (`string`, optional): Your application's own ID for this user. Example: f1ffa2b2-c20b-4d39-be5c-212726e11222 - `first_name` (`string`, optional): First name of the user. Example: Marcelina - `last_name` (`string`, optional): Last name of the user. Example: Davis - `metadata` (`object`, optional): Key/value pairs of string metadata to store on the user. Example: {"department": "Engineering"} - `name` (`string`, optional): Full name of the user. Example: Marcelina Davis - `password` (`string`, optional): Password to set for the user. Leave empty for a passwordless user who signs in with Magic Auth, SSO, or OAuth. Example: i8uv6g34kd490s Example input: `{"email":""}` ### `workos_user_update` Update User · Write Update an AuthKit user's profile fields; fields you leave out stay unchanged. Returns the updated user with its email, names, email_verified, external_id, metadata, and locale. Use this to change a user's name, email, password, external ID, metadata, or locale; use workos_user_create for a new user. Requires a user ID from workos_users_list. Read only: no. Destructive: no. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Unique ID of the user to update. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5 - `email` (`string`, optional): New email address for the user. Example: marcelina@example.com - `email_verified` (`boolean`, optional): Whether the user's email is verified. Example: true - `external_id` (`string`, optional): Your application's own ID for this user. Example: f1ffa2b2-c20b-4d39-be5c-212726e11222 - `first_name` (`string`, optional): New first name. Example: Marcelina - `last_name` (`string`, optional): New last name. Example: Davis - `locale` (`string`, optional): The user's preferred locale, as an IETF language tag. Example: en-US - `metadata` (`object`, optional): Key/value pairs of string metadata to store on the user. Example: {"department": "Engineering"} - `name` (`string`, optional): New full name. Example: Marcelina Davis - `password` (`string`, optional): New password for the user. Example: i8uv6g34kd490s Example input: `{"user_id":""}` ### `workos_connection_delete` Delete Connection · Destructive Permanently delete an SSO or OAuth connection; this cannot be undone. Returns no content on success. Use this only to remove a customer's SSO connection for good; users can no longer sign in through it. Requires a connection ID from workos_connections_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `connection_id` (`string`, required): Unique ID of the connection to delete. Get it from workos_connections_list. Example: conn_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"connection_id":""}` ### `workos_directory_delete` Delete Directory · Destructive Permanently delete a Directory Sync directory and stop syncing from it; this cannot be undone. Returns no content on success. Use this only to disconnect a customer's directory for good. Requires a directory ID from workos_directories_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `directory_id` (`string`, required): Unique ID of the directory to delete. Get it from workos_directories_list. Example: directory_01ECAZ4NV9QMV47GW873HDCX74 Example input: `{"directory_id":""}` ### `workos_group_delete` Delete Group · Destructive Delete a group from an organization. Returns no content on success. Use this to remove a group entirely; use workos_group_member_remove to take one member out of a group. Requires organization and group IDs from workos_groups_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"group_id":"","organization_id":""}` ### `workos_group_member_remove` Remove Group Member · Destructive Remove an organization membership from a group. Returns no content on success. Use this to take a member out of one group without affecting their organization membership; use workos_group_member_add to add them back. Requires a group ID from workos_groups_list and a membership ID from workos_group_members_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `group_id` (`string`, required): Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5 - `organization_id` (`string`, required): Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT - `organization_membership_id` (`string`, required): Unique ID of the organization membership to remove. Get it from workos_group_members_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"group_id":"","organization_id":"","organization_membership_id":""}` ### `workos_membership_role_assignment_remove` Remove Membership Role Assignment · Destructive Remove one role assignment from an organization membership by its ID. Returns no content on success. Use this to revoke a resource-level role; use workos_membership_role_assignments_list first to find the assignment ID. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 - `role_assignment_id` (`string`, required): Unique ID of the role assignment to remove. Get it from workos_membership_role_assignments_list. Example: role_assignment_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"organization_membership_id":"","role_assignment_id":""}` ### `workos_organization_delete` Delete Organization · Destructive Permanently delete a WorkOS organization; this cannot be undone. Returns no content on success. Use this only to remove an organization entirely; to remove one user from an organization use workos_organization_membership_delete. Requires an organization ID from workos_organizations_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `organization_id` (`string`, required): Unique ID of the organization to delete. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT Example input: `{"organization_id":""}` ### `workos_organization_domain_delete` Delete Organization Domain · Destructive Permanently remove a domain from an organization; this cannot be undone. Returns no content on success. Use this to release a domain the organization no longer owns. Requires an organization domain ID from workos_organization_get (domains[].id). Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `organization_domain_id` (`string`, required): Unique ID of the organization domain to delete. Get it from workos_organization_get (domains[].id). Example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A Example input: `{"organization_domain_id":""}` ### `workos_organization_membership_delete` Delete Organization Membership · Destructive Permanently remove a user's membership in an organization; this cannot be undone. Returns no content on success. Use this to remove someone from an organization for good; use workos_organization_membership_deactivate to suspend access while keeping roles. Requires a membership ID from workos_organization_memberships_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `organization_membership_id` (`string`, required): Unique ID of the organization membership to delete. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"organization_membership_id":""}` ### `workos_user_delete` Delete User · Destructive Permanently delete an AuthKit user; this cannot be undone. Returns no content on success. Use this to remove a user entirely; to remove a user from just one organization use workos_organization_membership_delete or workos_organization_membership_deactivate. Requires a user ID from workos_users_list. Read only: no. Destructive: yes. Idempotent (safe to retry): yes. Inputs: - `user_id` (`string`, required): Unique ID of the user to delete. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5 Example input: `{"user_id":""}` ## Related Other Developer Tools connectors ([all 117](/agentkit/connectors/?category=developer-tools)): - [GitHub](/agentkit/connectors/github/): Scalekit connector, OAuth, 217 tools - [Microsoft Entra ID](/agentkit/connectors/microsoftentraid/): Scalekit connector, OAuth, 82 tools - [Datadog](/agentkit/connectors/datadog/): Scalekit connector, API key, 105 tools --- ## More Scalekit documentation | Resource | What it contains | When to use it | |----------|-----------------|----------------| | [/llms.txt](/llms.txt) | Structured index with routing hints per product area | Start here — find which documentation set covers your topic before loading full content | | [/llms-full.txt](/llms-full.txt) | Complete documentation for all Scalekit products in one file | Use when you need exhaustive context across multiple products or when the topic spans several areas | | [sitemap-0.xml](https://docs.scalekit.com/sitemap-0.xml) | Full URL list of every documentation page | Use to discover specific page URLs you can fetch for targeted, page-level answers |