WorkOS for AI agents
Agents read WorkOS at once. Changes and sends are held for a person's approval by default.
About WorkOS
WorkOS provides enterprise identity and user management APIs for organizations, directory sync, connections, invitations, and users.
What an agent can do in WorkOS
Every WorkOS action is classed by the platform as a read, a change or a send. Reads run at once. Changes and sends are held for a person by default.
Runs at once (reads)
Looks things up in WorkOS without asking first. 15 actions.
- Get ConnectionGet one WorkOS connection by ID.
- Get DirectoryGet one WorkOS Directory Sync directory by ID.
- Get Directory GroupGet one WorkOS Directory Sync group by its exact group ID.
- Get Directory UserGet one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by
- Get InvitationGet WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials.
- Get OrganizationGet one WorkOS organization by its WorkOS ID or external ID.
- Get Organization MembershipGet one WorkOS AuthKit organization membership by ID.
- Get UserGet one WorkOS AuthKit user by WorkOS ID or external ID.
- List DirectoriesList one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain.
- List Directory GroupsList one page of WorkOS Directory Sync groups for a directory, a directory user, or both.
- List Directory UsersList one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per se
- List InvitationsList one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials.
Show all 15
- List Organization MembershipsList one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships.
- List OrganizationsList one page of WorkOS organizations, optionally filtered by domain or organization name.
- List UsersList one page of WorkOS AuthKit users, optionally filtered by organization or exact email address.
Held for approval by default (changes and sends)
Held for a person's approval by default. The approval is recorded and the action is sent once, never twice, with 10 seconds to undo. 13 actions.
- Create OrganizationCreate a WorkOS organization in the connected environment.
- Create Organization MembershipGrant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated.
- Create UserCreate a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords.
- Delete OrganizationPermanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID.
- Delete Organization MembershipPermanently remove an organization membership and its access. Prefer deactivation when access may need to be restored.
- Delete UserPermanently delete an AuthKit user. This cannot be undone and may remove the user's access.
- Resend InvitationSend another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation. This externally visible email delivery cannot be undone. The response excludes the invitation token
- Revoke InvitationRevoke a pending AuthKit invitation so it can no longer be accepted.
- Send InvitationCreate an AuthKit invitation and immediately send a real invitation email to the recipient. This externally visible email delivery cannot be undone. Use only when the recipient and delivery are intent
- Set Organization Membership StatusActivate or deactivate a WorkOS organization membership without deleting it. Deactivation removes access but can be reversed by setting the status to active.
- Update OrganizationUpdate selected properties of an existing WorkOS organization.
- Update Organization Membership RolesReplace the role assignment on an existing WorkOS organization membership.
Show all 13
- Update UserUpdate selected profile fields on an AuthKit user without invoking email delivery flows.
Changes wait in Needs you
Changes and sends in WorkOS are held for a person's approval by default. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.
Related connectors
WorkOS questions
Can an agent change data in WorkOS on its own?
Not by default. Changes and sends in WorkOS are held for a person's approval. The approval is recorded, and the action is sent once, never twice, with 10 seconds to undo.
What can an agent read in WorkOS?
This connector lists 15 read actions. Reads run at once, without waiting for approval.
How does WorkOS connect?
It connects with API key. Connectors are built and maintained by third-party developers; availability is confirmed during scoping.