---
canonical_url: "https://docs.composio.dev/toolkits/workos"
markdown_url: "https://docs.composio.dev/toolkits/workos.md"
product: "platform"
version: null
last_updated: null
---

# WorkOS

WorkOS provides enterprise identity and user management APIs for organizations, directory sync, connections, invitations, and users.

- **Category:** security & identity tools
- **Auth:** API_KEY
- **Composio-managed OAuth available?** N/A
- **Tools:** 29
- **Triggers:** 0
- **Slug:** `WORKOS`
- **Version:** 00000000_00

## Tools

### Create Organization

**Slug:** `WORKOS_CREATE_ORGANIZATION`

Create a WorkOS organization in the connected environment.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `name` | string | Yes | Organization display name. |
| `metadata` | object | No | Optional metadata with at most 50 pairs. Keys may contain up to 40 characters and values up to 600 characters. |
| `domain_data` | array | No | Domains to associate with the organization. Each record must include a domain and verification state. |
| `external_id` | string | No | Optional ASCII external identifier, up to 128 characters. |
| `allow_profiles_outside_organization` | boolean | No | Whether profiles outside this organization may sign in. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create Organization Membership

**Slug:** `WORKOS_CREATE_ORGANIZATION_MEMBERSHIP`

Grant an AuthKit user active membership in an organization. An existing inactive membership for the same user and organization is reactivated.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `user_id` | string | Yes | WorkOS user to grant organization access. |
| `role_slug` | string | No | One role slug to assign. Omit both role fields to use the default role; do not provide this with role_slugs. |
| `role_slugs` | array | No | Role slugs to assign when Multiple Roles is enabled. Omit both role fields to use the default role; do not provide this with role_slug. |
| `organization_id` | string | Yes | WorkOS organization the user will join. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Create User

**Slug:** `WORKOS_CREATE_USER`

Create a passwordless AuthKit user record in the connected WorkOS environment. This tool does not accept plaintext or hashed passwords.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `name` | string | No | Full name for the new user, or null when it is not known. |
| `email` | string | Yes | Email address for the new user. |
| `metadata` | object | No | Optional metadata with at most 50 pairs. Keys may contain up to 40 characters and values up to 600 characters. |
| `last_name` | string | No | Last name for the new user, or null when it is not known. |
| `first_name` | string | No | First name for the new user, or null when it is not known. |
| `external_id` | string | No | Optional ASCII external identifier, up to 128 characters. |
| `email_verified` | boolean | No | Whether the email has already been independently verified. Set this only when verification is backed by trusted evidence. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Organization

**Slug:** `WORKOS_DELETE_ORGANIZATION`

Permanently delete a WorkOS organization. This cannot be undone and should only target a confirmed organization ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `organization_id` | string | Yes | Exact WorkOS organization ID to permanently delete. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete Organization Membership

**Slug:** `WORKOS_DELETE_ORGANIZATION_MEMBERSHIP`

Permanently remove an organization membership and its access. Prefer deactivation when access may need to be restored.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `membership_id` | string | Yes | Exact WorkOS organization membership ID to permanently delete. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Delete User

**Slug:** `WORKOS_DELETE_USER`

Permanently delete an AuthKit user. This cannot be undone and may remove the user's access.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `user_id` | string | Yes | Exact WorkOS user ID to permanently delete. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Connection

**Slug:** `WORKOS_GET_CONNECTION`

Get one WorkOS connection by ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `connection_id` | string | Yes | WorkOS connection ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Directory

**Slug:** `WORKOS_GET_DIRECTORY`

Get one WorkOS Directory Sync directory by ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `directory_id` | string | Yes | WorkOS directory ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Directory Group

**Slug:** `WORKOS_GET_DIRECTORY_GROUP`

Get one WorkOS Directory Sync group by its exact group ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `directory_group_id` | string | Yes | Exact WorkOS directory group ID to retrieve. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Directory User

**Slug:** `WORKOS_GET_DIRECTORY_USER`

Get one WorkOS Directory Sync user by exact ID, including identity-provider attributes, roles, and any groups returned by WorkOS. For complete group memberships, use List Directory Groups filtered by this directory user ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `directory_user_id` | string | Yes | Exact WorkOS directory user ID to retrieve. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Invitation

**Slug:** `WORKOS_GET_INVITATION`

Get WorkOS AuthKit invitation status and metadata by invitation ID without exposing acceptance credentials.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `invitation_id` | string | Yes | WorkOS invitation ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Organization

**Slug:** `WORKOS_GET_ORGANIZATION`

Get one WorkOS organization by its WorkOS ID or external ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `external_id` | string | No | Your external organization ID. Provide exactly one identifier. |
| `organization_id` | string | No | WorkOS organization ID. Provide exactly one identifier. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get Organization Membership

**Slug:** `WORKOS_GET_ORGANIZATION_MEMBERSHIP`

Get one WorkOS AuthKit organization membership by ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `membership_id` | string | Yes | WorkOS organization membership ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Get User

**Slug:** `WORKOS_GET_USER`

Get one WorkOS AuthKit user by WorkOS ID or external ID.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `user_id` | string | No | WorkOS user ID. Provide exactly one identifier. |
| `external_id` | string | No | Your external user ID. Provide exactly one identifier. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Connections

**Slug:** `WORKOS_LIST_CONNECTIONS`

List one page of WorkOS SSO and OAuth connections, optionally filtered by connection type, domain, organization, or name.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum connections to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned connections. |
| `domain` | string | No | Return connections associated with this domain. |
| `search` | string | No | Text to match against connection names. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |
| `connection_type` | string ("ADFSSAML" | "AdpOidc" | "AppleOAuth" | "Auth0SAML" | "AzureSAML" | "BitbucketOAuth" | "CasSAML" | "ClassLinkSAML" | "CleverOIDC" | "CloudflareSAML" | "CyberArkSAML" | "DiscordOAuth" | "DuoSAML" | "EntraIdOIDC" | "GenericOIDC" | "GenericSAML" | "GitLabOAuth" | "GithubOAuth" | "GoogleOAuth" | "GoogleOIDC" | "GoogleSAML" | "GrokOAuth" | "IntuitOAuth" | "JumpCloudSAML" | "KeycloakSAML" | "LastPassSAML" | "LinkedInOAuth" | "LoginGovOidc" | "MagicLink" | "MicrosoftOAuth" | "MiniOrangeSAML" | "NetIqSAML" | "OktaOIDC" | "OktaSAML" | "OneLoginSAML" | "OracleSAML" | "PingFederateSAML" | "PingOneSAML" | "RipplingSAML" | "SalesforceOAuth" | "SalesforceSAML" | "ShibbolethGenericSAML" | "ShibbolethSAML" | "SimpleSamlPhpSAML" | "SlackOAuth" | "VercelMarketplaceOAuth" | "VercelOAuth" | "VMwareSAML" | "XeroOAuth" | "XOAuth") | No | Exact WorkOS connection type, such as OktaSAML or GoogleOAuth. |
| `organization_id` | string | No | Return connections associated with this WorkOS organization ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Directories

**Slug:** `WORKOS_LIST_DIRECTORIES`

List one page of WorkOS Directory Sync directories, optionally filtered by organization, directory name, or domain.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum directories to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned directories. |
| `domain` | string | No | Return directories associated with this domain. |
| `search` | string | No | Text to match against directory names. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |
| `organization_id` | string | No | Return directories associated with this WorkOS organization ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Directory Groups

**Slug:** `WORKOS_LIST_DIRECTORY_GROUPS`

List one page of WorkOS Directory Sync groups for a directory, a directory user, or both.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum groups to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned directory groups. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |
| `directory_id` | string | No | WorkOS directory whose groups to list. Provide directory_id, directory_user_id, or both. |
| `directory_user_id` | string | No | WorkOS directory user whose groups to list. Provide directory_id, directory_user_id, or both. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Directory Users

**Slug:** `WORKOS_LIST_DIRECTORY_USERS`

List one page of WorkOS Directory Sync users for a directory or group, optionally filtering a directory by exact identity-provider ID or primary email. WorkOS limits this endpoint to 4 requests per second per directory; on HTTP 429, honor Retry-After before retrying.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `email` | string | No | Exact primary email address to match. This filter requires directory_id. |
| `limit` | integer | No | Maximum directory users to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned directory users. |
| `idp_id` | string | No | Exact identity-provider user ID to match. This filter requires directory_id. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |
| `directory_id` | string | No | Directory whose users to list. Provide this or directory_group_id. Required when filtering by idp_id or email. |
| `directory_group_id` | string | No | Directory group whose users to list. Provide this or directory_id. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Invitations

**Slug:** `WORKOS_LIST_INVITATIONS`

List one page of WorkOS AuthKit invitations by organization or exact recipient email without exposing acceptance credentials.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `email` | string | No | Exact recipient email address to match. |
| `limit` | integer | No | Maximum invitations to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned invitations. |
| `next_cursor` | string | No | Opaque cursor returned by a previous call. Omit for the first page. |
| `organization_id` | string | No | Return invitations associated with this WorkOS organization ID. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Organization Memberships

**Slug:** `WORKOS_LIST_ORGANIZATION_MEMBERSHIPS`

List one page of WorkOS AuthKit organization memberships for a specific organization or user, optionally including inactive or pending memberships.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum memberships to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned memberships. |
| `user_id` | string | No | User whose memberships to list. Provide this or organization_id. |
| `statuses` | array | No | Membership statuses to include. WorkOS returns only active memberships when this filter is omitted. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |
| `organization_id` | string | No | Organization whose memberships to list. Provide this or user_id. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Organizations

**Slug:** `WORKOS_LIST_ORGANIZATIONS`

List one page of WorkOS organizations, optionally filtered by domain or organization name.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `limit` | integer | No | Maximum organizations to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned organizations. |
| `search` | string | No | Text to match against organization names. |
| `domains` | array | No | Return organizations matching any supplied domain. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### List Users

**Slug:** `WORKOS_LIST_USERS`

List one page of WorkOS AuthKit users, optionally filtered by organization or exact email address.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `email` | string | No | Exact user email address to match. |
| `limit` | integer | No | Maximum users to return in this page (1-100). |
| `order` | string ("asc" | "desc") | No | Creation-time order for returned users. |
| `next_cursor` | string | No | Cursor returned by a previous call. Omit for the first page. |
| `organization_id` | string | No | Return users belonging to this WorkOS organization. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Resend Invitation

**Slug:** `WORKOS_RESEND_INVITATION`

Send another real invitation email to the existing recipient of a pending WorkOS AuthKit invitation. This externally visible email delivery cannot be undone. The response excludes the invitation token and acceptance URL.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `locale` | string ("af" | "am" | "ar" | "bg" | "bn" | "bs" | "ca" | "cs" | "da" | "de" | "de-DE" | "el" | "en" | "en-AU" | "en-CA" | "en-GB" | "en-US" | "es" | "es-419" | "es-ES" | "es-US" | "et" | "fa" | "fi" | "fil" | "fr" | "fr-BE" | "fr-CA" | "fr-FR" | "fy" | "gl" | "gu" | "ha" | "he" | "hi" | "hr" | "hu" | "hy" | "id" | "is" | "it" | "it-IT" | "ja" | "jv" | "ka" | "kk" | "km" | "kn" | "ko" | "lt" | "lv" | "mk" | "ml" | "mn" | "mr" | "ms" | "my" | "nb" | "ne" | "nl" | "nl-BE" | "nl-NL" | "nn" | "no" | "pa" | "pl" | "pt" | "pt-BR" | "pt-PT" | "ro" | "ru" | "sk" | "sl" | "sq" | "sr" | "sv" | "sw" | "ta" | "te" | "th" | "tr" | "uk" | "ur" | "uz" | "vi" | "zh" | "zh-CN" | "zh-HK" | "zh-TW" | "zu") | No | Supported WorkOS locale for the real invitation email. |
| `invitation_id` | string | Yes | Pending WorkOS invitation to email again. Calling this tool sends a real email to the invitation's existing recipient. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Revoke Invitation

**Slug:** `WORKOS_REVOKE_INVITATION`

Revoke a pending AuthKit invitation so it can no longer be accepted.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `invitation_id` | string | Yes | WorkOS invitation to revoke. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Send Invitation

**Slug:** `WORKOS_SEND_INVITATION`

Create an AuthKit invitation and immediately send a real invitation email to the recipient. This externally visible email delivery cannot be undone. Use only when the recipient and delivery are intentional. The output omits the sensitive acceptance token and acceptance URL.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `email` | string | Yes | Recipient email address. Calling this tool sends a real email. |
| `locale` | string ("af" | "am" | "ar" | "bg" | "bn" | "bs" | "ca" | "cs" | "da" | "de" | "de-DE" | "el" | "en" | "en-AU" | "en-CA" | "en-GB" | "en-US" | "es" | "es-419" | "es-ES" | "es-US" | "et" | "fa" | "fi" | "fil" | "fr" | "fr-BE" | "fr-CA" | "fr-FR" | "fy" | "gl" | "gu" | "ha" | "he" | "hi" | "hr" | "hu" | "hy" | "id" | "is" | "it" | "it-IT" | "ja" | "jv" | "ka" | "kk" | "km" | "kn" | "ko" | "lt" | "lv" | "mk" | "ml" | "mn" | "mr" | "ms" | "my" | "nb" | "ne" | "nl" | "nl-BE" | "nl-NL" | "nn" | "no" | "pa" | "pl" | "pt" | "pt-BR" | "pt-PT" | "ro" | "ru" | "sk" | "sl" | "sq" | "sr" | "sv" | "sw" | "ta" | "te" | "th" | "tr" | "uk" | "ur" | "uz" | "vi" | "zh" | "zh-CN" | "zh-HK" | "zh-TW" | "zu") | No | Supported locale in which WorkOS renders the hosted invitation email. |
| `role_slug` | string | No | Role granted when the organization invitation is accepted. |
| `expires_in_days` | integer | No | Number of days the invitation remains valid (1-30). |
| `inviter_user_id` | string | No | WorkOS user whose name will appear as the inviter in the email. |
| `organization_id` | string | No | WorkOS organization the recipient will join after accepting. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Set Organization Membership Status

**Slug:** `WORKOS_SET_ORGANIZATION_MEMBERSHIP_STATUS`

Activate or deactivate a WorkOS organization membership without deleting it. Deactivation removes access but can be reversed by setting the status to active.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `status` | string ("active" | "inactive") | Yes | Desired access state. Active reactivates an inactive membership; inactive deactivates an active membership. Pending is not supported. |
| `membership_id` | string | Yes | WorkOS organization membership whose access state will change. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Update Organization

**Slug:** `WORKOS_UPDATE_ORGANIZATION`

Update selected properties of an existing WorkOS organization.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `name` | string | No | New organization name. |
| `metadata` | object | No | Replacement metadata with at most 50 pairs, or null to clear it. Keys may contain up to 40 characters and values up to 600 characters. |
| `domain_data` | array | No | Replacement domain records. Each record must include a domain and verification state. |
| `external_id` | string | No | Replacement ASCII external ID, or null to clear it. |
| `organization_id` | string | Yes | WorkOS organization ID. |
| `stripe_customer_id` | string | No | Stripe customer ID associated with the organization. |
| `allow_profiles_outside_organization` | boolean | No | New outside-profile sign-in policy. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Update Organization Membership Roles

**Slug:** `WORKOS_UPDATE_ORGANIZATION_MEMBERSHIP_ROLES`

Replace the role assignment on an existing WorkOS organization membership.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `role_slug` | string | No | One replacement role slug. Omit both role fields to use the default role; do not provide this with role_slugs. |
| `role_slugs` | array | No | Complete replacement role set for environments with Multiple Roles enabled. Omit both role fields to use the default role; do not provide this with role_slug. |
| `membership_id` | string | Yes | WorkOS organization membership ID whose roles will be replaced. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |

### Update User

**Slug:** `WORKOS_UPDATE_USER`

Update selected profile fields on an AuthKit user without invoking email delivery flows.

#### Input Parameters

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `name` | string | No | Replacement full name. |
| `email` | string | No | Replacement email address. |
| `locale` | string | No | Preferred locale, or null to clear it. |
| `user_id` | string | Yes | WorkOS user ID. |
| `metadata` | object | No | Replacement metadata with at most 50 pairs, or null to clear it. Keys may contain up to 40 characters and values up to 600 characters. |
| `last_name` | string | No | Replacement last name. |
| `first_name` | string | No | Replacement first name. |
| `external_id` | string | No | Replacement ASCII external ID, or null to clear it. |
| `email_verified` | boolean | No | Replacement verification state. Set this only from trusted evidence. |

#### Output

| Parameter | Type | Required | Description |
|-----------|------|----------|-------------|
| `data` | string | Yes | Data from the action execution |
| `error` | string | No | Error if any occurred during the execution of the action |
| `successful` | boolean | Yes | Whether or not the action execution was successful or not |