The WorkOS connector lets your AI agent act in each user's WorkOS account. Each user connects their own WorkOS access token once, and Scalekit sends it with every call, so your agent never handles credentials. It comes with 73 tools.
- Tools
- 73
- What they doRead · write · destructive
- 40 · 24 · 940 read24 write9 destructive
- Users sign in with
- Access token
Setup
Install the SDK
Terminal window npm install @scalekit-sdk/node dotenvTerminal window pip install scalekit-sdk-python python-dotenvSet your credentials
Add your Scalekit credentials to your
.envfile. Find values in app.scalekit.com > Developers > API Credentials..env SCALEKIT_ENVIRONMENT_URL=<your-environment-url>SCALEKIT_CLIENT_ID=<your-client-id>SCALEKIT_CLIENT_SECRET=<your-client-secret>Create the WorkOS connection
In AgentKit > Connections, create a WorkOS connection. The name you give it is the
connection_nameyour code passes. See Configure connections.Authorize a user and make your first call
quickstart.mts import { ScalekitClient } from '@scalekit-sdk/node'import 'dotenv/config'import { createInterface } from 'node:readline/promises'const scalekit = new ScalekitClient(process.env.SCALEKIT_ENVIRONMENT_URL,process.env.SCALEKIT_CLIENT_ID,process.env.SCALEKIT_CLIENT_SECRET,)const actions = scalekit.actionsconst connector = 'workos'const identifier = 'user_123'// Generate an authorization link for the userconst { link } = await actions.getAuthorizationLink({ connectionName: connector, identifier })console.log('Authorize WorkOS:', link)const rl = createInterface({ input: process.stdin, output: process.stdout })await rl.question('Press Enter after authorizing...')rl.close()// Make your first callconst result = await actions.executeTool({connector,identifier,toolName: 'workos_audit_log_actions_list',toolInput: {},})console.log(result)Terminal window npx tsx quickstart.mtsquickstart.py import osfrom scalekit import ScalekitClientfrom dotenv import load_dotenvload_dotenv()scalekit_client = ScalekitClient(env_url=os.getenv("SCALEKIT_ENVIRONMENT_URL"),client_id=os.getenv("SCALEKIT_CLIENT_ID"),client_secret=os.getenv("SCALEKIT_CLIENT_SECRET"),)actions = scalekit_client.actionsconnection_name = "workos"identifier = "user_123"# Generate an authorization link for the userlink_response = actions.get_authorization_link(connection_name=connection_name,identifier=identifier,)print("Authorize WorkOS:", link_response.link)input("Press Enter after authorizing...")# Make your first callresult = actions.execute_tool(tool_input={},tool_name="workos_audit_log_actions_list",connection_name=connection_name,identifier=identifier,)print(result)Terminal window python quickstart.pyEach user opens the link once and enters their WorkOS credentials there. See Authorize a user for the full flow and statuses.
Tools
Pass the exact name toexecute_toolworkos_audit_log_actions_listList the audit log actions configured in the WorkOS environment.Read-onlyList Audit Log Actions
List the audit log actions configured in the WorkOS environment. Returns a page of actions, each with its name and current schema, plus list_metadata cursors. Use this to see which action names workos_audit_log_event_create accepts; use workos_audit_log_schemas_list for one action's schema versions.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: user.signed_in
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: user.signed_in
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_audit_log_export_getGet the status of an audit log export and, once ready, its download URL.Read-onlyGet Audit Log Export
Get the status of an audit log export and, once ready, its download URL. Returns the export's state (pending, ready, or error) and url; the URL expires after 10 minutes, and fetching the export again issues a new one. Use this after workos_audit_log_export_create to wait for the export and download it.
Inputs
audit_log_export_idstringrequired- Unique ID of the audit log export. Get it from workos_audit_log_export_create. Example: audit_log_export_01GBZK5MP7TD1YCFQHFR22180V
workos_audit_log_schemas_listList the schema versions of one audit log action.Read-onlyList Audit Log Schemas
List the schema versions of one audit log action. Returns a page of schemas with version, actor, targets, and metadata definitions. Use this to see what fields an action's events must carry; use workos_audit_log_actions_list to find action names.
Inputs
action_namestringrequired- Name of the audit log action. Get it from workos_audit_log_actions_list. Example: user.signed_in
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: audit_log_schema_01GBZK5MP7TD1YCFQHFR22180V
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: audit_log_schema_01GBZK5MP7TD1YCFQHFR22180V
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_connection_getGet one SSO or OAuth connection by its ID.Read-onlyGet Connection
Get one SSO or OAuth connection by its ID. Returns the connection's name, connection_type, state (active, inactive, draft), organization_id, and domains. Use this to check whether a customer's SSO is active; use workos_connections_list to find connections by organization.
Inputs
connection_idstringrequired- Unique ID of the connection. Get it from workos_connections_list. Example: conn_01E4ZCR3C56J083X43JQXF3JK5
workos_connections_listList SSO and OAuth connections, optionally filtered by organization, type, domain, or a name search.Read-onlyList Connections
List SSO and OAuth connections, optionally filtered by organization, type, domain, or a name search. Returns a page of connections (id, organization_id, connection_type, name, state, domains) plus list_metadata cursors. Use this to find an organization's SSO connection; use workos_connection_get when you have a connection ID.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: conn_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: conn_01E4ZCR3C56J083X43JQXF3JK5
connection_typestring- Return only connections of this type. Example: OktaSAMLone of
ADFSSAMLAdpOidcAppleOAuthAuth0SAMLAzureSAMLBitbucketOAuthCasSAMLCloudflareSAMLClassLinkSAMLCleverOIDCCyberArkSAMLDuoSAMLEntraIdOIDCGenericOIDCGenericSAMLGithubOAuthGitLabOAuthGoogleOAuthGoogleOIDCGoogleSAMLIntuitOAuthJumpCloudSAMLKeycloakSAMLLastPassSAMLLinkedInOAuthLoginGovOidcMagicLinkMicrosoftOAuthMiniOrangeSAMLNetIqSAMLOktaOIDCOktaSAMLOneLoginSAMLOracleSAMLPingFederateSAMLPingOneSAMLRipplingSAMLSalesforceSAMLShibbolethGenericSAMLShibbolethSAMLSimpleSamlPhpSAMLSalesforceOAuthSlackOAuthVercelMarketplaceOAuthVercelOAuthVMwareSAMLXeroOAuth domainstring- Return connections associated with this domain. Example: foo-corp.com
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc organization_idstring- Return connections that belong to this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
searchstring- Text to match against connection names. Example: Foo Corp
workos_directories_listList Directory Sync directories, optionally filtered by organization, domain, or a name search.Read-onlyList Directories
List Directory Sync directories, optionally filtered by organization, domain, or a name search. Returns a page of directories (id, organization_id, name, type such as okta scim v2.0, state, domain) plus list_metadata cursors. Use this to find a customer's connected directory; use workos_directory_get when you have a directory ID.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: directory_01ECAZ4NV9QMV47GW873HDCX74
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: directory_01ECAZ4NV9QMV47GW873HDCX74
domainstring- Return directories associated with this domain. Example: foo-corp.com
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc organization_idstring- Return directories that belong to this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
searchstring- Text to match against directory names. Example: Foo Corp Okta
workos_directory_getGet one Directory Sync directory by its ID.Read-onlyGet Directory
Get one Directory Sync directory by its ID. Returns the directory's name, type, state, domain, organization_id, and user and group counts. Use this to check a directory's sync state; use workos_directories_list to find directories by organization.
Inputs
directory_idstringrequired- Unique ID of the directory. Get it from workos_directories_list. Example: directory_01ECAZ4NV9QMV47GW873HDCX74
workos_directory_group_getGet one directory group synced from a customer's identity provider.Read-onlyGet Directory Group
Get one directory group synced from a customer's identity provider. Returns the group's name, idp_id, directory_id, organization_id, and raw_attributes. Use this when you have a directory_group_ ID; use workos_directory_groups_list to find groups in a directory.
Inputs
directory_group_idstringrequired- Unique ID of the directory group. Get it from workos_directory_groups_list. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z
workos_directory_groups_listList groups synced from a customer's directory, filtered by directory or by a directory user.Read-onlyList Directory Groups
List groups synced from a customer's directory, filtered by directory or by a directory user. Returns a page of directory groups (id, idp_id, directory_id, organization_id, name, raw_attributes) plus list_metadata cursors. Use this for groups provisioned from an identity provider; use workos_groups_list for groups you manage in WorkOS. Provide directory or user; get IDs from workos_directories_list or workos_directory_users_list.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z
directorystring- ID of the directory to list groups from. Provide this or user. Example: directory_01ECAZ4NV9QMV47GW873HDCX74
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc userstring- ID of a directory user; returns only the groups that user belongs to. Provide this or directory. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
workos_directory_user_getGet one directory user synced from a customer's identity provider.Read-onlyGet Directory User
Get one directory user synced from a customer's identity provider. Returns the user's emails, names, job_title, username, state, role, groups, custom_attributes, and raw_attributes from the provider. Use this when you have a directory_user_ ID; use workos_directory_users_list to find users in a directory or group.
Inputs
directory_user_idstringrequired- Unique ID of the directory user. Get it from workos_directory_users_list. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
workos_directory_users_listList users synced from a customer's directory, filtered by directory or directory group.Read-onlyList Directory Users
List users synced from a customer's directory, filtered by directory or directory group. Returns a page of directory users (id, email, first_name, last_name, state, job_title, groups, custom_attributes, raw_attributes) plus list_metadata cursors. Use this for users provisioned from an identity provider; use workos_users_list for AuthKit users, or workos_directory_user_get for one directory user. Provide directory or group; get IDs from workos_directories_list or workos_directory_groups_list.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: directory_user_01E1JG7J09H96KYP8HM9B0G5SJ
directorystring- ID of the directory to list users from. Provide this or group. Example: directory_01ECAZ4NV9QMV47GW873HDCX74
emailstring- Return the directory user with this primary email. Requires directory. Example: marcelina@foo-corp.com
groupstring- ID of a directory group; returns only users in that group. Provide this or directory. Example: directory_group_01E1JJS84MFPPQ3G655FHTKX6Z
idp_idstring- Return the directory user with this identity-provider ID. Requires directory. Example: 2836
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_events_listList events from the WorkOS environment's event stream, filtered by event type and optionally by organization or date range.Read-onlyList Events
List events from the WorkOS environment's event stream, filtered by event type and optionally by organization or date range. Returns a page of events (id, event type, data payload, context, created_at) plus list_metadata cursors. Use this to see what changed recently, such as dsync.user.created or user.created; use the resource-specific list tools for current state.
Inputs
eventsstringrequired- Comma-separated event types to return (required by WorkOS). Example: dsync.user.created,dsync.user.updated,user.created
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: event_01H2GNQD5B3SV2V3Z8TKW0Y3TX
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: event_01H2GNQD5B3SV2V3Z8TKW0Y3TX
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc organization_idstring- Return only events for this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
range_endstring- Return events created before this ISO-8601 date-time. Example: 2025-01-31T23:59:59Z
range_startstring- Return events created after this ISO-8601 date-time. Example: 2025-01-01T00:00:00Z
workos_feature_flag_getGet one feature flag by its slug.Read-onlyGet Feature Flag
Get one feature flag by its slug. Returns the flag's name, description, enabled state, default_value, tags, and owner. Use this to check whether a flag is on in the environment; use workos_feature_flags_list to browse flags.
Inputs
flag_slugstringrequired- Slug of the feature flag. Get it from workos_feature_flags_list. Example: advanced-analytics
workos_feature_flags_listList the feature flags defined in the WorkOS environment.Read-onlyList Feature Flags
List the feature flags defined in the WorkOS environment. Returns a page of flags (id, slug, name, description, enabled, default_value, tags, owner) plus list_metadata cursors. Use this to browse all flags; use workos_organization_feature_flags_list or workos_user_feature_flags_list to see flags enabled for one organization or user.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: flag_01HXYZ123456789ABCDEFGHIJ
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: flag_01HXYZ123456789ABCDEFGHIJ
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_group_getGet one group in an organization by its ID.Read-onlyGet Group
Get one group in an organization by its ID. Returns the group's name, description, organization_id, and timestamps. Use this when you have a group ID; use workos_groups_list to find groups in an organization.
Inputs
group_idstringrequired- Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_group_members_listList the organization memberships that belong to one group.Read-onlyList Group Members
List the organization memberships that belong to one group. Returns a page of memberships (id, user_id, organization_id, status) plus list_metadata cursors. Use this to see who is in a group; use workos_organization_membership_groups_list for one member's groups. Requires organization and group IDs from workos_groups_list.
Inputs
group_idstringrequired- Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: om_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: om_01E4ZCR3C56J083X43JQXF3JK5
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_groups_listList the groups in one organization, optionally searching by name or group ID.Read-onlyList Groups
List the groups in one organization, optionally searching by name or group ID. Returns a page of groups (id, organization_id, name, description) plus list_metadata cursors. Use this for groups managed in WorkOS; use workos_directory_groups_list for groups synced from a customer's identity provider. Requires an organization ID from workos_organizations_list.
Inputs
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: group_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: group_01E4ZCR3C56J083X43JQXF3JK5
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc searchstring- Text to match against group names or group IDs. Example: Engineering
workos_invitation_getGet one AuthKit invitation by its ID.Read-onlyGet Invitation
Get one AuthKit invitation by its ID. Returns the invitation's email, state (pending, accepted, expired, or revoked), organization_id, role_slug, inviter_user_id, expires_at, and accept_invitation_url. Use this to check an invitation's status; use workos_invitations_list to find invitations by email or organization.
Inputs
invitation_idstringrequired- Unique ID of the invitation. Get it from workos_invitations_list. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5
workos_invitations_listList AuthKit invitations, optionally filtered by organization or recipient email.Read-onlyList Invitations
List AuthKit invitations, optionally filtered by organization or recipient email. Returns a page of invitations (id, email, state, organization_id, role_slug, expires_at, accept_invitation_url) plus list_metadata cursors. Use this to find pending or past invitations; use workos_invitation_get when you have an invitation ID.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5
emailstring- Return invitations sent to this email address. Example: marcelina@example.com
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc organization_idstring- Return invitations to this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_membership_role_assignments_listList the role assignments of one organization membership, across the organization and its sub-resources.Read-onlyList Membership Role Assignments
List the role assignments of one organization membership, across the organization and its sub-resources. Returns a page of role assignments (id, role slug, resource, source) plus list_metadata cursors. Use this to see every role a member holds and on which resource; use workos_organization_membership_get for the member's organization-level role. Requires a membership ID from workos_organization_memberships_list.
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: role_assignment_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: role_assignment_01E4ZCR3C56J083X43JQXF3JK5
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc resource_external_idstring- Return only assignments on the resource with this external ID. Example: project-123
resource_idstring- Return only assignments on this resource ID. Example: authz_resource_01HXYZ123456789ABCDEFGHIJ
resource_type_slugstring- Return only assignments on resources of this type. Example: project
workos_organization_domain_getGet one organization domain by its ID.Read-onlyGet Organization Domain
Get one organization domain by its ID. Returns the domain, its state (pending, verified, failed), verification_strategy, verification_prefix, verification_token, and organization_id. Use this to check a domain's verification state or read the DNS values to publish; use workos_organization_get to see all of an organization's domains.
Inputs
organization_domain_idstringrequired- Unique ID of the organization domain. Get it from workos_organization_get (domains[].id). Example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A
workos_organization_feature_flags_listList the feature flags enabled for one organization.Read-onlyList Organization Feature Flags
List the feature flags enabled for one organization. Returns a page of enabled flags (slug, name, enabled, default_value, tags) plus list_metadata cursors. Use this to see what an organization has turned on; use workos_user_feature_flags_list for one user, or workos_feature_flags_list for every flag. Requires an organization ID from workos_organizations_list.
Inputs
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: flag_01HXYZ123456789ABCDEFGHIJ
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: flag_01HXYZ123456789ABCDEFGHIJ
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to desc. Example: descone of
normaldescasc
workos_organization_getGet one WorkOS organization by its WorkOS ID.Read-onlyGet Organization
Get one WorkOS organization by its WorkOS ID. Returns the organization's name, domains with verification state, external_id, metadata, stripe_customer_id, and timestamps. Use this when you have the org_ ID; use workos_organization_get_by_external_id for your own app's ID, or workos_organizations_list to search.
Inputs
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_organization_get_by_external_idGet one WorkOS organization by the external ID your application assigned to it.Read-onlyGet Organization by External ID
Get one WorkOS organization by the external ID your application assigned to it. Returns the organization's id, name, domains, external_id, metadata, and timestamps. Use this when you know your own system's ID for the organization; use workos_organization_get when you have the WorkOS org_ ID.
Inputs
external_idstringrequired- The external ID your application set on the organization when creating or updating it. Example: 2fe01467-f7ea-4dd2-8b79-c2b4f56d0191
workos_organization_membership_getGet one organization membership by its ID.Read-onlyGet Organization Membership
Get one organization membership by its ID. Returns the membership's user_id, organization_id, status, role, roles, directory_managed flag, and the embedded user. Use this when you have an om_ ID; use workos_organization_memberships_list to find memberships by user or organization.
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
workos_organization_membership_groups_listList the groups that one organization membership belongs to.Read-onlyList Organization Membership Groups
List the groups that one organization membership belongs to. Returns a page of groups (id, organization_id, name, description) plus list_metadata cursors. Use this to see a member's groups; use workos_group_members_list for the members of one group. Requires a membership ID from workos_organization_memberships_list.
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: group_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: group_01E4ZCR3C56J083X43JQXF3JK5
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_organization_memberships_listList organization memberships for a user, an organization, or both, optionally filtered by status.Read-onlyList Organization Memberships
List organization memberships for a user, an organization, or both, optionally filtered by status. Returns a page of memberships (id, user_id, organization_id, status, role, roles, organization_name) plus list_metadata cursors. Use this to see who belongs to an organization or which organizations a user belongs to; use workos_organization_membership_get for one membership. Provide at least one of organization_id or user_id.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: om_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: om_01E4ZCR3C56J083X43JQXF3JK5
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc organization_idstring- Return memberships in this organization. Provide this, user_id, or both. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
statusesstring- Comma-separated membership statuses to include: active, inactive, pending. Only active memberships are returned when empty. Example: active,inactive
user_idstring- Return memberships of this user. Provide this, organization_id, or both. Example: user_01E4ZCR3C56J083X43JQXF3JK5
workos_organization_role_getGet one role that applies to an organization by its slug; it can be an environment role or a custom role.Read-onlyGet Organization Role
Get one role that applies to an organization by its slug; it can be an environment role or a custom role. Returns the role's name, description, type, and permission slugs. Use this to inspect a role in an organization's context; use workos_role_get for an environment role. Requires an organization ID from workos_organizations_list.
Inputs
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
role_slugstringrequired- Slug of the role. Get it from workos_organization_roles_list. Example: org-billing-admin
workos_organization_roles_listList every role that applies to one organization, including environment roles and the organization's custom roles, in priority order.Read-onlyList Organization Roles
List every role that applies to one organization, including environment roles and the organization's custom roles, in priority order. Returns roles with slug, name, description, type (EnvironmentRole or OrganizationRole), and permission slugs. Use this to see which roles can be given to an organization's members; use workos_roles_list for environment roles only. Requires an organization ID from workos_organizations_list.
Inputs
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_organizations_listList organizations in the WorkOS environment, optionally filtered by domain or a name search.Read-onlyList Organizations
List organizations in the WorkOS environment, optionally filtered by domain or a name search. Returns a page of organizations (id, name, domains, external_id, metadata, timestamps) plus list_metadata cursors. Use this to browse or find organizations; use workos_organization_get when you already have an organization ID, or workos_organization_get_by_external_id for your own app's ID.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
domainsstring- Comma-separated list of domains. Returns organizations that own any of these domains. Example: foo-corp.com,bar.com
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc searchstring- Text to match against organization names. Example: Foo Corp
workos_permission_getGet one permission by its slug.Read-onlyGet Permission
Get one permission by its slug. Returns the permission's name, description, system flag, and resource_type_slug. Use this to look up a permission referenced by a role; use workos_permissions_list to browse.
Inputs
permission_slugstringrequired- Slug of the permission. Get it from workos_permissions_list. Example: posts:read
workos_permissions_listList the permissions defined in the WorkOS environment.Read-onlyList Permissions
List the permissions defined in the WorkOS environment. Returns a page of permissions (id, slug, name, description, system, resource_type_slug) plus list_metadata cursors. Use this to browse available permissions; use workos_permission_get for one permission by slug.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: perm_01HXYZ123456789ABCDEFGHIJ
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: perm_01HXYZ123456789ABCDEFGHIJ
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_role_getGet one environment-level role by its slug.Read-onlyGet Environment Role
Get one environment-level role by its slug. Returns the role's name, description, type, and permission slugs. Use this to inspect a role's permissions; use workos_organization_role_get for a role that may be custom to one organization.
Inputs
role_slugstringrequired- Slug of the environment role. Get it from workos_roles_list. Example: admin
workos_roles_listList the environment-level roles defined in WorkOS, in priority order.Read-onlyList Environment Roles
List the environment-level roles defined in WorkOS, in priority order. Returns roles with slug, name, description, type, and their permission slugs. Use this to see roles available to every organization; use workos_organization_roles_list to include an organization's custom roles.
Inputs
This tool takes no inputs.
workos_user_feature_flags_listList the feature flags enabled for one user, including flags enabled through the organizations they belong to.Read-onlyList User Feature Flags
List the feature flags enabled for one user, including flags enabled through the organizations they belong to. Returns a page of enabled flags (slug, name, enabled, default_value, tags) plus list_metadata cursors. Use this to see what a user has access to; use workos_organization_feature_flags_list for an organization. Requires a user ID from workos_users_list.
Inputs
user_idstringrequired- Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: flag_01HXYZ123456789ABCDEFGHIJ
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: flag_01HXYZ123456789ABCDEFGHIJ
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to desc. Example: descone of
normaldescasc
workos_user_getGet one AuthKit user by WorkOS user ID.Read-onlyGet User
Get one AuthKit user by WorkOS user ID. Returns the user's email, first and last name, email_verified, profile_picture_url, external_id, metadata, locale, and last_sign_in_at. Use this when you have the user_ ID; use workos_user_get_by_external_id for your own app's ID, or workos_users_list to search by email.
Inputs
user_idstringrequired- Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5
workos_user_get_by_external_idGet one AuthKit user by the external ID your application assigned to it.Read-onlyGet User by External ID
Get one AuthKit user by the external ID your application assigned to it. Returns the user's id, email, names, email_verified, external_id, metadata, and timestamps. Use this when you know your own system's ID for the user; use workos_user_get when you have the WorkOS user_ ID.
Inputs
external_idstringrequired- The external ID your application set on the user. Example: f1ffa2b2-c20b-4d39-be5c-212726e11222
workos_user_identities_getGet the OAuth identities linked to one AuthKit user.Read-onlyGet User Identities
Get the OAuth identities linked to one AuthKit user. Returns an array of identities, each with idp_id, type, and provider (for example GoogleOAuth or GitHubOAuth). Use this to see which social or OAuth providers a user signs in with; use workos_user_get for the user's profile. Requires a user ID from workos_users_list.
Inputs
user_idstringrequired- Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5
workos_user_sessions_listList the active sessions of one AuthKit user.Read-onlyList User Sessions
List the active sessions of one AuthKit user. Returns a page of sessions (id, ip_address, user_agent, organization_id, auth_method, status, expires_at, impersonator) plus list_metadata cursors. Use this to audit where a user is signed in or to find a session ID for workos_session_revoke. Requires a user ID from workos_users_list.
Inputs
user_idstringrequired- Unique ID of the user. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: session_01H93ZY4F80QPBEZ1R5B2SHQG8
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: session_01H93ZY4F80QPBEZ1R5B2SHQG8
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc
workos_users_listList AuthKit users in the WorkOS environment, optionally filtered by organization or exact email.Read-onlyList Users
List AuthKit users in the WorkOS environment, optionally filtered by organization or exact email. Returns a page of users (id, email, first_name, last_name, email_verified, external_id, last_sign_in_at) plus list_metadata cursors. Use this to browse or find users; use workos_user_get when you have a user ID, or workos_directory_users_list for users synced from a customer's directory.
Inputs
afterstring- Pagination cursor for the next page. Pass the list_metadata.after value from the previous response to get the records that come after it. Leave empty for the first page. Example: user_01E4ZCR3C56J083X43JQXF3JK5
beforestring- Pagination cursor for the previous page. Pass the list_metadata.before value from a response to get the records that come before it. Example: user_01E4ZCR3C56J083X43JQXF3JK5
emailstring- Return only the user with this exact email address. Example: marcelina@example.com
limitinteger- Maximum number of records to return in one page, from 1 to 100. Defaults to 10. Example: 25default
10 orderstring- Sort order by creation time: desc (newest first), asc (oldest first), or normal (newest first with reversed cursor semantics). Defaults to normal (newest first). Example: descone of
normaldescasc organization_idstring- Return only users who are members of this organization. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_audit_log_event_createRecord an audit log event for an organization.WriteCreate Audit Log Event
Record an audit log event for an organization. Returns success: true once the event is accepted. Use this to write an entry to a customer's audit log; use workos_audit_log_export_create to read events back out. Requires an organization ID; the action should match one from workos_audit_log_actions_list.
Inputs
eventobjectrequired- The audit log event. It needs an action name, the time it occurred (ISO-8601), the actor who did it (id and type, optionally name and metadata), the targets it affected (each with id and type), and a context with the request location (IP address) and optional user_agent. Optional metadata and schema version can be added. Example: {"action": "user.signed_in", "occurred_at": "2025-01-15T12:00:00Z", "actor": {"id": "user_01GBNJC3MX9ZZJW1FSTF4C5938", "type": "user"}, "targets": [{"id": "team_01GBNJD4MKHVKJGEWK42JNMBGS", "type": "team"}], "context": {"location": "123.123.123.123", "user_agent": "Chrome/104.0.0.0"}}
organization_idstringrequired- ID of the organization the event belongs to. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_audit_log_export_createStart a CSV export of one organization's audit log events for a date range, optionally filtered by action, actor, or target.WriteCreate Audit Log Export
Start a CSV export of one organization's audit log events for a date range, optionally filtered by action, actor, or target. Returns the export with its ID and state (pending at first); the download url appears once it is ready. Use this to pull audit events out of WorkOS; then poll workos_audit_log_export_get until state is ready. Requires an organization ID from workos_organizations_list.
Inputs
organization_idstringrequired- ID of the organization to export events for. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
range_endstringrequired- End of the export range as an ISO-8601 date-time. Example: 2025-01-31T23:59:59Z
range_startstringrequired- Start of the export range as an ISO-8601 date-time. Example: 2025-01-01T00:00:00Z
actionsarray- Only export events with these action names. Example: ["user.signed_in"]
actor_idsarray- Only export events by actors with these IDs. Example: ["user_01GBZK5MP7TD1YCFQHFR22180V"]
actor_namesarray- Only export events by actors with these names. Example: ["Jon Smith"]
targetsarray- Only export events that affected these target types. Example: ["team"]
workos_feature_flag_disableTurn a feature flag off in the WorkOS environment.WriteDisable Feature Flag
Turn a feature flag off in the WorkOS environment. Returns the flag with enabled set to false. Use this to roll a feature back; use workos_feature_flag_enable to turn it on. Requires a flag slug from workos_feature_flags_list.
- Idempotent
Inputs
flag_slugstringrequired- Slug of the feature flag. Get it from workos_feature_flags_list. Example: advanced-analytics
workos_feature_flag_enableTurn a feature flag on in the WorkOS environment.WriteEnable Feature Flag
Turn a feature flag on in the WorkOS environment. Returns the flag with enabled set to true. Use this to roll a feature out; use workos_feature_flag_disable to turn it off. Requires a flag slug from workos_feature_flags_list.
- Idempotent
Inputs
flag_slugstringrequired- Slug of the feature flag. Get it from workos_feature_flags_list. Example: advanced-analytics
workos_group_createCreate a new group in an organization.WriteCreate Group
Create a new group in an organization. Returns the created group with its ID, name, and description. Use this to organize organization members; then use workos_group_member_add to add members. Requires an organization ID from workos_organizations_list.
Inputs
namestringrequired- Name of the group. Example: Engineering
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
descriptionstring- Optional description of the group. Example: All engineering staff
workos_group_member_addAdd an organization membership to a group.WriteAdd Group Member
Add an organization membership to a group. Returns the group the member was added to. Use this to put a member into a group; use workos_group_member_remove to take them out. Requires a group ID from workos_groups_list and a membership ID from workos_organization_memberships_list.
Inputs
group_idstringrequired- Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
organization_membership_idstringrequired- ID of the organization membership to add to the group. Example: om_01E4ZCR3C56J083X43JQXF3JK5
workos_group_updateUpdate a group's name or description; fields you leave out stay unchanged.WriteUpdate Group
Update a group's name or description; fields you leave out stay unchanged. Returns the updated group. Use this to rename a group or change its description; use workos_group_create for a new group. Requires organization and group IDs from workos_groups_list.
Inputs
group_idstringrequired- Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
descriptionstring- New description for the group. Example: Platform and infrastructure engineers
namestring- New name for the group. Example: Platform Engineering
workos_invitation_resendSend the invitation email again for a pending AuthKit invitation.WriteResend Invitation
Send the invitation email again for a pending AuthKit invitation. Returns the invitation with its state and expires_at. Use this when the recipient lost or never got the email; use workos_invitation_send to invite someone new. Only pending invitations can be resent. Requires an invitation ID from workos_invitations_list.
Inputs
invitation_idstringrequired- Unique ID of the pending invitation. Get it from workos_invitations_list. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5
localestring- Language for the invitation email, as a locale code such as en, en-GB, fr, de, ja, or pt-BR. Defaults to the environment's locale. Example: en
workos_invitation_revokeRevoke an AuthKit invitation so it can no longer be accepted.WriteRevoke Invitation
Revoke an AuthKit invitation so it can no longer be accepted. Returns the invitation with state revoked and revoked_at set. Use this to cancel an invite sent by mistake; use workos_invitation_resend to send a pending invite again. Requires an invitation ID from workos_invitations_list.
Inputs
invitation_idstringrequired- Unique ID of the invitation to revoke. Get it from workos_invitations_list. Example: invitation_01E4ZCR3C56J083X43JQXF3JK5
workos_invitation_sendCreate an AuthKit invitation and email it to the recipient, optionally into an organization with a role.WriteSend Invitation
Create an AuthKit invitation and email it to the recipient, optionally into an organization with a role. Returns the invitation with its ID, state pending, expires_at, and accept_invitation_url. Use this to invite someone who does not have a user yet; use workos_organization_membership_create to add an existing user directly, or workos_invitation_resend to re-send a pending invite.
Inputs
emailstringrequired- Email address of the person to invite. Example: marcelina@example.com
expires_in_daysinteger- Number of days the invitation stays valid, from 1 to 30. Defaults to 7. Example: 14
inviter_user_idstring- ID of the user sending the invitation; the email mentions this user's name. Example: user_01E4ZCR3C56J083X43JQXF3JK5
localestring- Language for the invitation email, as a locale code such as en, en-GB, fr, de, ja, or pt-BR. Defaults to the environment's locale. Example: en
organization_idstring- Organization the recipient will join when they accept. Leave empty for an environment-level invite. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
role_slugstring- Role the recipient gets when they join the organization. Only valid with organization_id. Example: admin
workos_membership_role_assignAssign a role to an organization membership on a specific resource.WriteAssign Role to Membership
Assign a role to an organization membership on a specific resource. Returns the new role assignment with its ID, role, resource, and source. Use this for resource-level roles in Fine-Grained Authorization; use workos_organization_membership_update to change the member's organization-wide role. Requires a membership ID from workos_organization_memberships_list and either resource_id or resource_external_id plus resource_type_slug.
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
role_slugstringrequired- Slug of the role to assign. Example: editor
resource_external_idstring- Your application's ID for the resource. Use together with resource_type_slug, instead of resource_id. Example: project-123
resource_idstring- ID of the authorization resource. Provide this, or resource_external_id together with resource_type_slug. Example: authz_resource_01HXYZ123456789ABCDEFGHIJ
resource_type_slugstring- Slug of the resource type. Use together with resource_external_id. Example: project
workos_organization_createCreate a new organization in the WorkOS environment.WriteCreate Organization
Create a new organization in the WorkOS environment. Returns the created organization with its new org_ ID, name, domains, external_id, and metadata. Use this to add a customer organization; use workos_organization_update to change an existing one.
Inputs
namestringrequired- Name of the organization. Example: Foo Corp
allow_profiles_outside_organizationboolean- Whether users whose email domain is not one of the organization's domains may sign in through the organization's SSO connections. Example: false
domain_dataarray- Domains to attach to the organization, each with a domain and a verification state (pending or verified). Use verified only for domains you have already verified yourself. Example: [{"domain": "foo-corp.com", "state": "pending"}]
external_idstring- Your application's own ID for this organization, so you can look it up later with workos_organization_get_by_external_id. Example: 2fe01467-f7ea-4dd2-8b79-c2b4f56d0191
metadataobject- Key/value pairs of string metadata to store on the organization. Example: {"tier": "enterprise"}
workos_organization_domain_createAdd a domain to an organization; it starts in the pending state until verified.WriteCreate Organization Domain
Add a domain to an organization; it starts in the pending state until verified. Returns the organization domain with its ID, state, verification_strategy, verification_prefix, and verification_token for the DNS record. Use this to claim a new domain for an organization; then use workos_organization_domain_verify after the DNS TXT record is in place. Requires an organization ID from workos_organizations_list.
Inputs
domainstringrequired- Domain name to add. Example: foo-corp.com
organization_idstringrequired- ID of the organization to add the domain to. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_organization_domain_verifyStart the DNS verification check for a pending organization domain.WriteVerify Organization Domain
Start the DNS verification check for a pending organization domain. Returns the organization domain with its updated state. Use this after the customer has published the DNS TXT record from workos_organization_domain_get or workos_organization_domain_create. Requires an organization domain ID.
Inputs
organization_domain_idstringrequired- Unique ID of the organization domain to verify. Get it from workos_organization_domain_create or workos_organization_get (domains[].id). Example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A
workos_organization_membership_createAdd a user to an organization as an active member, optionally with specific roles.WriteCreate Organization Membership
Add a user to an organization as an active member, optionally with specific roles. Returns the membership with its om_ ID, user_id, organization_id, status, and role. Use this to give an existing user access to an organization; it also reactivates an inactive membership. Use workos_invitation_send to invite someone who has no user yet. Requires a user ID from workos_users_list and an organization ID from workos_organizations_list.
Inputs
organization_idstringrequired- ID of the organization to add the user to. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
user_idstringrequired- ID of the user to add. Example: user_01E4ZCR3C56J083X43JQXF3JK5
role_slugstring- Slug of a single role to give the member. Defaults to the environment's default role (usually member). Do not combine with role_slugs. Example: admin
role_slugsarray- Several role slugs to give the member, when Multiple Roles is enabled for the environment. Do not combine with role_slug. Example: ["admin", "billing"]
workos_organization_membership_deactivateDeactivate an active organization membership so the user loses access but keeps their roles.WriteDeactivate Organization Membership
Deactivate an active organization membership so the user loses access but keeps their roles. Returns the membership with status inactive. Use this to suspend a member temporarily; use workos_organization_membership_reactivate to restore access, or workos_organization_membership_delete to remove it for good. Pending memberships cannot be deactivated. Requires a membership ID from workos_organization_memberships_list.
- Idempotent
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership to deactivate. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
workos_organization_membership_reactivateReactivate an inactive organization membership, keeping the roles it had before.WriteReactivate Organization Membership
Reactivate an inactive organization membership, keeping the roles it had before. Returns the membership with status active. Use this to restore access after workos_organization_membership_deactivate; use workos_organization_membership_create to add a user who has no membership. Requires a membership ID from workos_organization_memberships_list (pass statuses=inactive to find it).
- Idempotent
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership to reactivate. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
workos_organization_membership_updateChange the role or roles of an existing organization membership.WriteUpdate Organization Membership
Change the role or roles of an existing organization membership. Returns the updated membership with its status, role, and roles. Use this to promote or demote a member; use workos_organization_membership_deactivate to suspend access without changing roles. Requires a membership ID from workos_organization_memberships_list.
- Idempotent
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership to update. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
role_slugstring- Slug of the single role the member should have. Provide this or role_slugs. Example: admin
role_slugsarray- Role slugs the member should have, when Multiple Roles is enabled. Provide this or role_slug. Example: ["admin", "billing"]
workos_organization_updateUpdate an existing WorkOS organization; fields you leave out stay unchanged.WriteUpdate Organization
Update an existing WorkOS organization; fields you leave out stay unchanged. Returns the updated organization with its name, domains, external_id, metadata, and stripe_customer_id. Use this to rename an organization or change its domains, metadata, external ID, or Stripe customer ID; use workos_organization_create for a new one. Requires an organization ID from workos_organizations_list.
- Idempotent
Inputs
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
allow_profiles_outside_organizationboolean- Whether users whose email domain is not one of the organization's domains may sign in through its SSO connections. Example: false
domain_dataarray- Replacement list of domains, each with a domain and a verification state (pending or verified). Example: [{"domain": "foo-corp.com", "state": "verified"}]
external_idstring- Your application's own ID for this organization. Example: 2fe01467-f7ea-4dd2-8b79-c2b4f56d0191
metadataobject- Key/value pairs of string metadata to store on the organization. Example: {"tier": "enterprise"}
namestring- New name for the organization. Example: Foo Corp
stripe_customer_idstring- Stripe customer ID to associate with the organization. Example: cus_R9qWAGMQ6nGE7V
workos_portal_link_generateGenerate a short-lived Admin Portal link that lets a customer's IT admin set up SSO, Directory Sync, domain verification, audit log streams, or certificate renewal for their organization.WriteGenerate Admin Portal Link
Generate a short-lived Admin Portal link that lets a customer's IT admin set up SSO, Directory Sync, domain verification, audit log streams, or certificate renewal for their organization. Returns link, a URL to send to the customer's IT admin. Use this when a customer needs to configure their own SSO or directory; use workos_connections_list or workos_directories_list to check the result afterwards. Requires an organization ID from workos_organizations_list.
Inputs
organizationstringrequired- ID of the organization the Admin Portal link is for. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
external_user_idstring- ID of the user in your application the link is generated for, so the link and its sessions can be revoked later. Example: user_123
intentstring- Which Admin Portal flow to open: sso, dsync, audit_logs, log_streams, domain_verification, certificate_renewal, or bring_your_own_key. Example: ssoone of
ssodsyncaudit_logslog_streamsdomain_verificationcertificate_renewalbring_your_own_key it_contact_emailsarray- Email addresses of IT contacts to grant Admin Portal access for this organization, up to 20. Example: ["it-admin@foo-corp.com"]
return_urlstring- URL to send the admin to when they click your logo in the Admin Portal. Defaults to the URL set in the WorkOS dashboard. Example: https://example.com/settings
success_urlstring- URL to redirect the admin to after they finish setup. Defaults to the URL set in the WorkOS dashboard. Example: https://example.com/sso/success
workos_session_revokeRevoke one AuthKit user session so it can no longer be used.WriteRevoke Session
Revoke one AuthKit user session so it can no longer be used. Returns no content on success. Use this to sign a user out of a specific session; use workos_user_sessions_list first to find the session ID.
Inputs
session_idstringrequired- ID of the session to revoke, from workos_user_sessions_list or the sid claim of an access token. Example: session_01H93ZY4F80QPBEZ1R5B2SHQG8
workos_user_createCreate a new AuthKit user in the WorkOS environment, optionally with a password.WriteCreate User
Create a new AuthKit user in the WorkOS environment, optionally with a password. Returns the created user with its new user_ ID, email, names, email_verified, and external_id. Use this to add a user record directly; use workos_invitation_send to email someone an invite instead, and workos_organization_membership_create to add the user to an organization.
Inputs
emailstringrequired- Email address of the user. WorkOS trims whitespace and lowercases it. Example: marcelina@example.com
email_verifiedboolean- Whether the user's email is already verified. Set true only if your application has verified it. Example: false
external_idstring- Your application's own ID for this user. Example: f1ffa2b2-c20b-4d39-be5c-212726e11222
first_namestring- First name of the user. Example: Marcelina
last_namestring- Last name of the user. Example: Davis
metadataobject- Key/value pairs of string metadata to store on the user. Example: {"department": "Engineering"}
namestring- Full name of the user. Example: Marcelina Davis
passwordstring- Password to set for the user. Leave empty for a passwordless user who signs in with Magic Auth, SSO, or OAuth. Example: i8uv6g34kd490s
workos_user_updateUpdate an AuthKit user's profile fields; fields you leave out stay unchanged.WriteUpdate User
Update an AuthKit user's profile fields; fields you leave out stay unchanged. Returns the updated user with its email, names, email_verified, external_id, metadata, and locale. Use this to change a user's name, email, password, external ID, metadata, or locale; use workos_user_create for a new user. Requires a user ID from workos_users_list.
- Idempotent
Inputs
user_idstringrequired- Unique ID of the user to update. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5
emailstring- New email address for the user. Example: marcelina@example.com
email_verifiedboolean- Whether the user's email is verified. Example: true
external_idstring- Your application's own ID for this user. Example: f1ffa2b2-c20b-4d39-be5c-212726e11222
first_namestring- New first name. Example: Marcelina
last_namestring- New last name. Example: Davis
localestring- The user's preferred locale, as an IETF language tag. Example: en-US
metadataobject- Key/value pairs of string metadata to store on the user. Example: {"department": "Engineering"}
namestring- New full name. Example: Marcelina Davis
passwordstring- New password for the user. Example: i8uv6g34kd490s
workos_connection_deletePermanently delete an SSO or OAuth connection; this cannot be undone.DestructiveDelete Connection
Permanently delete an SSO or OAuth connection; this cannot be undone. Returns no content on success. Use this only to remove a customer's SSO connection for good; users can no longer sign in through it. Requires a connection ID from workos_connections_list.
- Idempotent
Inputs
connection_idstringrequired- Unique ID of the connection to delete. Get it from workos_connections_list. Example: conn_01E4ZCR3C56J083X43JQXF3JK5
workos_directory_deletePermanently delete a Directory Sync directory and stop syncing from it; this cannot be undone.DestructiveDelete Directory
Permanently delete a Directory Sync directory and stop syncing from it; this cannot be undone. Returns no content on success. Use this only to disconnect a customer's directory for good. Requires a directory ID from workos_directories_list.
- Idempotent
Inputs
directory_idstringrequired- Unique ID of the directory to delete. Get it from workos_directories_list. Example: directory_01ECAZ4NV9QMV47GW873HDCX74
workos_group_deleteDelete a group from an organization.DestructiveDelete Group
Delete a group from an organization. Returns no content on success. Use this to remove a group entirely; use workos_group_member_remove to take one member out of a group. Requires organization and group IDs from workos_groups_list.
- Idempotent
Inputs
group_idstringrequired- Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_group_member_removeRemove an organization membership from a group.DestructiveRemove Group Member
Remove an organization membership from a group. Returns no content on success. Use this to take a member out of one group without affecting their organization membership; use workos_group_member_add to add them back. Requires a group ID from workos_groups_list and a membership ID from workos_group_members_list.
- Idempotent
Inputs
group_idstringrequired- Unique ID of the group. Get it from workos_groups_list. Example: group_01E4ZCR3C56J083X43JQXF3JK5
organization_idstringrequired- Unique ID of the organization. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
organization_membership_idstringrequired- Unique ID of the organization membership to remove. Get it from workos_group_members_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
workos_membership_role_assignment_removeRemove one role assignment from an organization membership by its ID.DestructiveRemove Membership Role Assignment
Remove one role assignment from an organization membership by its ID. Returns no content on success. Use this to revoke a resource-level role; use workos_membership_role_assignments_list first to find the assignment ID.
- Idempotent
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
role_assignment_idstringrequired- Unique ID of the role assignment to remove. Get it from workos_membership_role_assignments_list. Example: role_assignment_01E4ZCR3C56J083X43JQXF3JK5
workos_organization_deletePermanently delete a WorkOS organization; this cannot be undone.DestructiveDelete Organization
Permanently delete a WorkOS organization; this cannot be undone. Returns no content on success. Use this only to remove an organization entirely; to remove one user from an organization use workos_organization_membership_delete. Requires an organization ID from workos_organizations_list.
- Idempotent
Inputs
organization_idstringrequired- Unique ID of the organization to delete. Get it from workos_organizations_list. Example: org_01EHZNVPK3SFK441A1RGBFSHRT
workos_organization_domain_deletePermanently remove a domain from an organization; this cannot be undone.DestructiveDelete Organization Domain
Permanently remove a domain from an organization; this cannot be undone. Returns no content on success. Use this to release a domain the organization no longer owns. Requires an organization domain ID from workos_organization_get (domains[].id).
- Idempotent
Inputs
organization_domain_idstringrequired- Unique ID of the organization domain to delete. Get it from workos_organization_get (domains[].id). Example: org_domain_01EHZNVPK2QXHMVWCEDQEKY69A
workos_organization_membership_deletePermanently remove a user's membership in an organization; this cannot be undone.DestructiveDelete Organization Membership
Permanently remove a user's membership in an organization; this cannot be undone. Returns no content on success. Use this to remove someone from an organization for good; use workos_organization_membership_deactivate to suspend access while keeping roles. Requires a membership ID from workos_organization_memberships_list.
- Idempotent
Inputs
organization_membership_idstringrequired- Unique ID of the organization membership to delete. Get it from workos_organization_memberships_list. Example: om_01E4ZCR3C56J083X43JQXF3JK5
workos_user_deletePermanently delete an AuthKit user; this cannot be undone.DestructiveDelete User
Permanently delete an AuthKit user; this cannot be undone. Returns no content on success. Use this to remove a user entirely; to remove a user from just one organization use workos_organization_membership_delete or workos_organization_membership_deactivate. Requires a user ID from workos_users_list.
- Idempotent
Inputs
user_idstringrequired- Unique ID of the user to delete. Get it from workos_users_list. Example: user_01E4ZCR3C56J083X43JQXF3JK5
No tools match.
