WorkOS

Create a WorkOS organization in the connected environment.

Grant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated.

Create a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords.

Permanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID.

Permanently remove an organization membership and its access. Prefer deactivation when access may need to be restored.

Permanently delete an AuthKit user. This cannot be undone and may remove the user's access.

Get one WorkOS connection by ID.

Get one WorkOS Directory Sync directory by ID.

Get one WorkOS Directory Sync group by its exact group ID.

Get one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by this directory user ID.

Get WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials.

Get one WorkOS organization by its WorkOS ID or external ID.

Get one WorkOS AuthKit organization membership by ID.

Get one WorkOS AuthKit user by WorkOS ID or external ID.

List one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name.

List one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain.

List one page of WorkOS Directory Sync groups for a directory, a directory user, or both.

List one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per second per directory; on HTTP 429, honor Retry-After before retrying.

List one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials.

List one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships.

List one page of WorkOS organizations, optionally filtered by domain or organization name.

List one page of WorkOS AuthKit users, optionally filtered by organization or exact email address.

Send another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation. This externally visible email delivery cannot be undone. The response excludes the invitation token and acceptance URL.

Revoke a pending AuthKit invitation so it can no longer be accepted.

Create an AuthKit invitation and immediately send a real invitation email to the recipient. This externally visible email delivery cannot be undone. Use only when the recipient and delivery are intentional. The output omits the sensitive acceptance token and acceptance URL.

Activate or deactivate a WorkOS organization membership without deleting it. Deactivation removes access but can be reversed by setting the status to active.

Update selected properties of an existing WorkOS organization.

Replace the role assignment on an existing WorkOS organization membership.

Update selected profile fields on an AuthKit user without invoking email delivery flows.