KosmoKrator

productivity

WorkOS Lua API for KosmoKrator Agents

Agent-facing Lua documentation and function reference for the WorkOS KosmoKrator integration.

Lua Namespace

Agents call this integration through app.integrations.workos.*. Use lua_read_doc("integrations.workos") inside KosmoKrator to discover the same reference at runtime.

Call Lua from the Headless CLI

Use kosmo integrations:lua when a shell script, CI job, cron job, or another coding CLI should run a deterministic WorkOS workflow without starting an interactive agent session.

Inline Lua call
kosmo integrations:lua --eval 'dump(app.integrations.workos.validate_api_key({}))' --json
Read Lua docs headlessly
kosmo integrations:lua --eval 'print(docs.read("workos"))' --json
kosmo integrations:lua --eval 'print(docs.read("workos.validate_api_key"))' --json

Workflow file

Put repeatable logic in a Lua file, then execute it with JSON output for the calling process.

workflow.lua
local workos = app.integrations.workos
local result = workos.validate_api_key({})

dump(result)
Run the workflow
kosmo integrations:lua workflow.lua --json
kosmo integrations:lua workflow.lua --force --json
Namespace note. integrations:lua exposes app.integrations.workos, app.mcp.*, docs.*, json.*, and regex.*. Use app.integrations.workos.default.* or app.integrations.workos.work.* when you configured named credential accounts.

MCP-only Lua

If the script only needs configured MCP servers and does not need WorkOS, use the narrower mcp:lua command.

MCP Lua command
# Use mcp:lua for MCP-only scripts; use integrations:lua for this integration namespace.
kosmo mcp:lua --eval 'dump(mcp.servers())' --json

Agent-Facing Lua Docs

This is the rendered version of the full Lua documentation exposed to agents when they inspect the integration namespace.

WorkOS Lua Docs

WorkOS tools are exposed under app.integrations.workos. This package is generated from WorkOS’s official open-source OpenAPI specification and exposes all 172 operations found in that spec.

Configure api_key and optionally url. The default URL is https://api.workos.com.

Pass path, query, and header parameters as top-level snake_case arguments. Pass JSON request bodies under body.

local orgs = app.integrations.workos.workos_organizations_list({ limit = 25 })
local user = app.integrations.workos.workos_user_management_users_get({ user_id = "user_123" })

Coverage Notes

The manifest workos-openapi-manifest.json records source URL, operation IDs, methods, paths, tool slugs, and classes. Some endpoints can use user/session access tokens instead of an API key; configure the appropriate bearer token for those calls.

Representative Tools

  • workos_api_keys_validate_api_key - POST /api_keys/validations
  • workos_api_keys_delete - DELETE /api_keys/{id}
  • workos_audit_log_validators_list - GET /audit_logs/actions
  • workos_audit_log_validator_versions_create - POST /audit_logs/actions/{actionName}/schemas
  • workos_audit_log_validator_versions_schemas - GET /audit_logs/actions/{actionName}/schemas
  • workos_audit_log_events_create - POST /audit_logs/events
  • workos_audit_log_exports_exports - POST /audit_logs/exports
  • workos_audit_log_exports_export - GET /audit_logs/exports/{auditLogExportId}
  • workos_authentication_challenges_verify - POST /auth/challenges/{id}/verify
  • workos_authentication_factors_create - POST /auth/factors/enroll
  • workos_authentication_factors_get - GET /auth/factors/{id}
  • workos_authentication_factors_delete - DELETE /auth/factors/{id}
  • workos_authentication_factors_challenge - POST /auth/factors/{id}/challenge
  • workos_external_auth_complete_login - POST /authkit/oauth2/complete
  • workos_authorization_check - POST /authorization/organization_memberships/{organization_membership_id}/check
  • workos_authorization_list_resources_for_membership - GET /authorization/organization_memberships/{organization_membership_id}/resources
  • workos_authorization_list_effective_permissions - GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions
  • workos_authorization_list_effective_permissions_by_external_id - GET /authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions
Raw agent markdown
# WorkOS Lua Docs

WorkOS tools are exposed under `app.integrations.workos`. This package is generated from WorkOS's official open-source OpenAPI specification and exposes all 172 operations found in that spec.

Configure `api_key` and optionally `url`. The default URL is `https://api.workos.com`.

Pass path, query, and header parameters as top-level snake_case arguments. Pass JSON request bodies under `body`.

```lua
local orgs = app.integrations.workos.workos_organizations_list({ limit = 25 })
local user = app.integrations.workos.workos_user_management_users_get({ user_id = "user_123" })
```

## Coverage Notes

The manifest `workos-openapi-manifest.json` records source URL, operation IDs, methods, paths, tool slugs, and classes. Some endpoints can use user/session access tokens instead of an API key; configure the appropriate bearer token for those calls.

## Representative Tools

- `workos_api_keys_validate_api_key` - POST `/api_keys/validations`
- `workos_api_keys_delete` - DELETE `/api_keys/{id}`
- `workos_audit_log_validators_list` - GET `/audit_logs/actions`
- `workos_audit_log_validator_versions_create` - POST `/audit_logs/actions/{actionName}/schemas`
- `workos_audit_log_validator_versions_schemas` - GET `/audit_logs/actions/{actionName}/schemas`
- `workos_audit_log_events_create` - POST `/audit_logs/events`
- `workos_audit_log_exports_exports` - POST `/audit_logs/exports`
- `workos_audit_log_exports_export` - GET `/audit_logs/exports/{auditLogExportId}`
- `workos_authentication_challenges_verify` - POST `/auth/challenges/{id}/verify`
- `workos_authentication_factors_create` - POST `/auth/factors/enroll`
- `workos_authentication_factors_get` - GET `/auth/factors/{id}`
- `workos_authentication_factors_delete` - DELETE `/auth/factors/{id}`
- `workos_authentication_factors_challenge` - POST `/auth/factors/{id}/challenge`
- `workos_external_auth_complete_login` - POST `/authkit/oauth2/complete`
- `workos_authorization_check` - POST `/authorization/organization_memberships/{organization_membership_id}/check`
- `workos_authorization_list_resources_for_membership` - GET `/authorization/organization_memberships/{organization_membership_id}/resources`
- `workos_authorization_list_effective_permissions` - GET `/authorization/organization_memberships/{organization_membership_id}/resources/{resource_id}/permissions`
- `workos_authorization_list_effective_permissions_by_external_id` - GET `/authorization/organization_memberships/{organization_membership_id}/resources/{resource_type_slug}/{external_id}/permissions`
Metadata-derived Lua example
local result = app.integrations.workos.validate_api_key({})
print(result)

Functions

validate_api_key Write

Validate an API key value and return the API key object if valid.

Lua path
app.integrations.workos.validate_api_key
Full name
workos.workos_api_keys_validate_api_key
ParameterTypeRequiredDescription
No parameters.
delete_api_key Write

Permanently deletes an API key. This action cannot be undone. Once deleted, any requests using this API key will fail authentication.

Lua path
app.integrations.workos.delete_api_key
Full name
workos.workos_api_keys_delete
ParameterTypeRequiredDescription
No parameters.
list_actions Read

Get a list of all Audit Log actions in the current environment.

Lua path
app.integrations.workos.list_actions
Full name
workos.workos_audit_log_validators_list
ParameterTypeRequiredDescription
No parameters.
create_schema Write

Creates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created.

Lua path
app.integrations.workos.create_schema
Full name
workos.workos_audit_log_validator_versions_create
ParameterTypeRequiredDescription
No parameters.
list_schemas Read

Get a list of all schemas for the Audit Logs action identified by `:name`.

Lua path
app.integrations.workos.list_schemas
Full name
workos.workos_audit_log_validator_versions_schemas
ParameterTypeRequiredDescription
No parameters.
create_event Write

Create an Audit Log Event. This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were pe...

Lua path
app.integrations.workos.create_event
Full name
workos.workos_audit_log_events_create
ParameterTypeRequiredDescription
No parameters.
create_export Write

Create an Audit Log Export. Exports are scoped to a single organization within a specified date range.

Lua path
app.integrations.workos.create_export
Full name
workos.workos_audit_log_exports_exports
ParameterTypeRequiredDescription
No parameters.
get_export Read

Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.

Lua path
app.integrations.workos.get_export
Full name
workos.workos_audit_log_exports_export
ParameterTypeRequiredDescription
No parameters.
verify_challenge Write

Verifies an Authentication Challenge.

Lua path
app.integrations.workos.verify_challenge
Full name
workos.workos_authentication_challenges_verify
ParameterTypeRequiredDescription
No parameters.
enroll_factor Write

Enrolls an Authentication Factor to be used as an additional factor of authentication. The returned ID should be used to create an authentication Challenge.

Lua path
app.integrations.workos.enroll_factor
Full name
workos.workos_authentication_factors_create
ParameterTypeRequiredDescription
No parameters.
get_factor Read

Gets an Authentication Factor.

Lua path
app.integrations.workos.get_factor
Full name
workos.workos_authentication_factors_get
ParameterTypeRequiredDescription
No parameters.
delete_factor Write

Permanently deletes an Authentication Factor. It cannot be undone.

Lua path
app.integrations.workos.delete_factor
Full name
workos.workos_authentication_factors_delete
ParameterTypeRequiredDescription
No parameters.
challenge_factor Write

Creates a Challenge for an Authentication Factor.

Lua path
app.integrations.workos.challenge_factor
Full name
workos.workos_authentication_factors_challenge
ParameterTypeRequiredDescription
No parameters.
complete_external_authentication Write

Completes an external authentication flow and returns control to AuthKit. This endpoint is used with [Standalone Connect](/authkit/connect/standalone) to bridge your existing au...

Lua path
app.integrations.workos.complete_external_authentication
Full name
workos.workos_external_auth_complete_login
ParameterTypeRequiredDescription
No parameters.
check_authorization Write

Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug.

Lua path
app.integrations.workos.check_authorization
Full name
workos.workos_authorization_check
ParameterTypeRequiredDescription
No parameters.
list_resources_organization_membership Read

Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects ca...

Lua path
app.integrations.workos.list_resources_organization_membership
Full name
workos.workos_authorization_list_resources_for_membership
ParameterTypeRequiredDescription
No parameters.
list_effective_permissions_organization_membership_resource Read

Returns all permissions the organization membership effectively has on a resource, including permissions inherited through roles assigned to ancestor resources.

Lua path
app.integrations.workos.list_effective_permissions_organization_membership_resource
Full name
workos.workos_authorization_list_effective_permissions
ParameterTypeRequiredDescription
No parameters.
list_effective_permissions_organization_membership_resource_by_external_id Read

Returns all permissions the organization membership effectively has on a resource identified by its external ID, including permissions inherited through roles assigned to ancest...

Lua path
app.integrations.workos.list_effective_permissions_organization_membership_resource_by_external_id
Full name
workos.workos_authorization_list_effective_permissions_by_external_id
ParameterTypeRequiredDescription
No parameters.
list_role_assignments Write

List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource ...

Lua path
app.integrations.workos.list_role_assignments
Full name
workos.workos_authorization_role_assignments_list_role_assignments
ParameterTypeRequiredDescription
No parameters.
assign_role Write

Assign a role to an organization membership on a specific resource.

Lua path
app.integrations.workos.assign_role
Full name
workos.workos_authorization_role_assignments_assign_role
ParameterTypeRequiredDescription
No parameters.
remove_role_assignment Write

Remove a role assignment by role slug and resource.

Lua path
app.integrations.workos.remove_role_assignment
Full name
workos.workos_authorization_role_assignments_remove_role_by_criteria
ParameterTypeRequiredDescription
No parameters.
remove_role_assignment_by_id Write

Remove a role assignment using its ID.

Lua path
app.integrations.workos.remove_role_assignment_by_id
Full name
workos.workos_authorization_role_assignments_remove_role_by_id
ParameterTypeRequiredDescription
No parameters.
create_custom_role Write

Create a new custom role for this organization.

Lua path
app.integrations.workos.create_custom_role
Full name
workos.workos_authorization_organization_roles_create
ParameterTypeRequiredDescription
No parameters.
list_custom_roles Read

Get a list of all roles that apply to an organization. This includes both environment roles and custom roles, returned in priority order.

Lua path
app.integrations.workos.list_custom_roles
Full name
workos.workos_authorization_organization_roles_list
ParameterTypeRequiredDescription
No parameters.
get_custom_role Read

Retrieve a role that applies to an organization by its slug. This can return either an environment role or a custom role.

Lua path
app.integrations.workos.get_custom_role
Full name
workos.workos_authorization_organization_roles_get
ParameterTypeRequiredDescription
No parameters.
update_custom_role Write

Update an existing custom role. Only the fields provided in the request body will be updated.

Lua path
app.integrations.workos.update_custom_role
Full name
workos.workos_authorization_organization_roles_update
ParameterTypeRequiredDescription
No parameters.
delete_custom_role Write

Delete an existing custom role.

Lua path
app.integrations.workos.delete_custom_role
Full name
workos.workos_authorization_organization_roles_delete
ParameterTypeRequiredDescription
No parameters.
set_permissions_custom_role Write

Replace all permissions on a custom role with the provided list.

Lua path
app.integrations.workos.set_permissions_custom_role
Full name
workos.workos_authorization_organization_role_permissions_set_permissions
ParameterTypeRequiredDescription
No parameters.
add_permission_custom_role Write

Add a single permission to a custom role. If the permission is already assigned to the role, this operation has no effect.

Lua path
app.integrations.workos.add_permission_custom_role
Full name
workos.workos_authorization_organization_role_permissions_add_permission
ParameterTypeRequiredDescription
No parameters.
remove_permission_from_custom_role Write

Remove a single permission from a custom role by its slug.

Lua path
app.integrations.workos.remove_permission_from_custom_role
Full name
workos.workos_authorization_organization_role_permissions_remove_permission
ParameterTypeRequiredDescription
No parameters.
get_resource_by_external_id Read

Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and nee...

Lua path
app.integrations.workos.get_resource_by_external_id
Full name
workos.workos_authorization_resources_by_external_id_get_by_external_id
ParameterTypeRequiredDescription
No parameters.
update_resource_by_external_id Write

Update an existing authorization resource using its external ID.

Lua path
app.integrations.workos.update_resource_by_external_id
Full name
workos.workos_authorization_resources_by_external_id_update_by_external_id
ParameterTypeRequiredDescription
No parameters.
delete_authorization_resource_by_external_id Write

Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources.

Lua path
app.integrations.workos.delete_authorization_resource_by_external_id
Full name
workos.workos_authorization_resources_by_external_id_delete_by_external_id
ParameterTypeRequiredDescription
No parameters.
list_memberships_resource_by_external_id Read

Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?...

Lua path
app.integrations.workos.list_memberships_resource_by_external_id
Full name
workos.workos_authorization_resources_by_external_id_list_organization_memberships_for_resource_by_external_id
ParameterTypeRequiredDescription
No parameters.
list_role_assignments_resource_by_external_id Write

List all role assignments granted on a resource, identified by its external ID. Each assignment includes the organization membership it was granted to.

Lua path
app.integrations.workos.list_role_assignments_resource_by_external_id
Full name
workos.workos_authorization_role_assignments_list_role_assignments_for_resource_by_external_id
ParameterTypeRequiredDescription
No parameters.
list_permissions Read

Get a list of all permissions in your WorkOS environment.

Lua path
app.integrations.workos.list_permissions
Full name
workos.workos_authorization_permissions_list
ParameterTypeRequiredDescription
No parameters.
create_permission Write

Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and custom roles.

Lua path
app.integrations.workos.create_permission
Full name
workos.workos_authorization_permissions_create
ParameterTypeRequiredDescription
No parameters.
get_permission Read

Retrieve a permission by its unique slug.

Lua path
app.integrations.workos.get_permission
Full name
workos.workos_authorization_permissions_find
ParameterTypeRequiredDescription
No parameters.
update_permission Write

Update an existing permission. Only the fields provided in the request body will be updated.

Lua path
app.integrations.workos.update_permission
Full name
workos.workos_authorization_permissions_update
ParameterTypeRequiredDescription
No parameters.
delete_permission Write

Delete an existing permission. System permissions cannot be deleted.

Lua path
app.integrations.workos.delete_permission
Full name
workos.workos_authorization_permissions_delete
ParameterTypeRequiredDescription
No parameters.
list_resources Read

Get a paginated list of authorization resources.

Lua path
app.integrations.workos.list_resources
Full name
workos.workos_authorization_resources_list
ParameterTypeRequiredDescription
No parameters.
create_authorization_resource Write

Create a new authorization resource.

Lua path
app.integrations.workos.create_authorization_resource
Full name
workos.workos_authorization_resources_create
ParameterTypeRequiredDescription
No parameters.
get_resource Read

Retrieve the details of an authorization resource by its ID.

Lua path
app.integrations.workos.get_resource
Full name
workos.workos_authorization_resources_find_by_id
ParameterTypeRequiredDescription
No parameters.
update_resource Write

Update an existing authorization resource.

Lua path
app.integrations.workos.update_resource
Full name
workos.workos_authorization_resources_update
ParameterTypeRequiredDescription
No parameters.
delete_authorization_resource Write

Delete an authorization resource and all its descendants.

Lua path
app.integrations.workos.delete_authorization_resource
Full name
workos.workos_authorization_resources_delete
ParameterTypeRequiredDescription
No parameters.
list_organization_memberships_resource Read

Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?".

Lua path
app.integrations.workos.list_organization_memberships_resource
Full name
workos.workos_authorization_resources_list_organization_memberships_for_resource
ParameterTypeRequiredDescription
No parameters.
list_role_assignments_resource Write

List all role assignments granted on a specific resource instance. Each assignment includes the organization membership it was granted to.

Lua path
app.integrations.workos.list_role_assignments_resource
Full name
workos.workos_authorization_role_assignments_list_role_assignments_for_resource
ParameterTypeRequiredDescription
No parameters.
create_environment_role Write

Create a new environment role.

Lua path
app.integrations.workos.create_environment_role
Full name
workos.workos_authorization_roles_create
ParameterTypeRequiredDescription
No parameters.
list_environment_roles Read

List all environment roles in priority order.

Lua path
app.integrations.workos.list_environment_roles
Full name
workos.workos_authorization_roles_list
ParameterTypeRequiredDescription
No parameters.
get_environment_role Read

Get an environment role by its slug.

Lua path
app.integrations.workos.get_environment_role
Full name
workos.workos_authorization_roles_get
ParameterTypeRequiredDescription
No parameters.
update_environment_role Write

Update an existing environment role.

Lua path
app.integrations.workos.update_environment_role
Full name
workos.workos_authorization_roles_update
ParameterTypeRequiredDescription
No parameters.
set_permissions_environment_role Write

Replace all permissions on an environment role with the provided list.

Lua path
app.integrations.workos.set_permissions_environment_role
Full name
workos.workos_authorization_role_permissions_set_permissions
ParameterTypeRequiredDescription
No parameters.
add_permission_environment_role Write

Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect.

Lua path
app.integrations.workos.add_permission_environment_role
Full name
workos.workos_authorization_role_permissions_add_permission
ParameterTypeRequiredDescription
No parameters.
list_connect_applications Read

List all Connect Applications in the current environment with optional filtering.

Lua path
app.integrations.workos.list_connect_applications
Full name
workos.workos_applications_list
ParameterTypeRequiredDescription
No parameters.
create_connect_application Write

Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.

Lua path
app.integrations.workos.create_connect_application
Full name
workos.workos_applications_create
ParameterTypeRequiredDescription
No parameters.
get_connect_application Read

Retrieve details for a specific Connect Application by ID or client ID.

Lua path
app.integrations.workos.get_connect_application
Full name
workos.workos_applications_find
ParameterTypeRequiredDescription
No parameters.
update_connect_application Write

Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.

Lua path
app.integrations.workos.update_connect_application
Full name
workos.workos_applications_update
ParameterTypeRequiredDescription
No parameters.
delete_connect_application Write

Delete an existing Connect Application.

Lua path
app.integrations.workos.delete_connect_application
Full name
workos.workos_applications_delete
ParameterTypeRequiredDescription
No parameters.
list_client_secrets_connect_application Read

List all client secrets associated with a Connect Application.

Lua path
app.integrations.workos.list_client_secrets_connect_application
Full name
workos.workos_application_credentials_list
ParameterTypeRequiredDescription
No parameters.
create_new_client_secret_connect_application Write

Create new secrets for a Connect Application.

Lua path
app.integrations.workos.create_new_client_secret_connect_application
Full name
workos.workos_application_credentials_create
ParameterTypeRequiredDescription
No parameters.
delete_client_secret Write

Delete (revoke) an existing client secret.

Lua path
app.integrations.workos.delete_client_secret
Full name
workos.workos_application_credentials_delete
ParameterTypeRequiredDescription
No parameters.
list_connections Read

Get a list of all of your existing connections matching the criteria specified.

Lua path
app.integrations.workos.list_connections
Full name
workos.workos_connections_list
ParameterTypeRequiredDescription
No parameters.
get_connection Read

Get the details of an existing connection.

Lua path
app.integrations.workos.get_connection
Full name
workos.workos_connections_find
ParameterTypeRequiredDescription
No parameters.
delete_connection Write

Permanently deletes an existing connection. It cannot be undone.

Lua path
app.integrations.workos.delete_connection
Full name
workos.workos_connections_delete
ParameterTypeRequiredDescription
No parameters.
get_authorization_url Write

Generates an OAuth authorization URL to initiate the connection flow for a user. Redirect the user to the returned URL to begin the OAuth flow with the third-party provider.

Lua path
app.integrations.workos.get_authorization_url
Full name
workos.workos_data_integrations_get_data_integration_authorize_url
ParameterTypeRequiredDescription
No parameters.
get_access_token_connected_account Write

Fetches a valid OAuth access token for a user's connected account. WorkOS automatically handles token refresh, ensuring you always receive a valid, non-expired token.

Lua path
app.integrations.workos.get_access_token_connected_account
Full name
workos.workos_data_integrations_get_userland_user_token
ParameterTypeRequiredDescription
No parameters.
list_directories Read

Get a list of all of your existing directories matching the criteria specified.

Lua path
app.integrations.workos.list_directories
Full name
workos.workos_directories_list
ParameterTypeRequiredDescription
No parameters.
get_directory Read

Get the details of an existing directory.

Lua path
app.integrations.workos.get_directory
Full name
workos.workos_directories_find
ParameterTypeRequiredDescription
No parameters.
delete_directory Write

Permanently deletes an existing directory. It cannot be undone.

Lua path
app.integrations.workos.delete_directory
Full name
workos.workos_directories_delete_directory
ParameterTypeRequiredDescription
No parameters.
list_directory_groups Read

Get a list of all of existing directory groups matching the criteria specified.

Lua path
app.integrations.workos.list_directory_groups
Full name
workos.workos_directory_groups_list
ParameterTypeRequiredDescription
No parameters.
get_directory_group Read

Get the details of an existing Directory Group.

Lua path
app.integrations.workos.get_directory_group
Full name
workos.workos_directory_groups_find
ParameterTypeRequiredDescription
No parameters.
list_directory_users Read

Get a list of all of existing Directory Users matching the criteria specified.

Lua path
app.integrations.workos.list_directory_users
Full name
workos.workos_directory_users_list
ParameterTypeRequiredDescription
No parameters.
get_directory_user Read

Get the details of an existing Directory User.

Lua path
app.integrations.workos.get_directory_user
Full name
workos.workos_directory_users_find
ParameterTypeRequiredDescription
No parameters.
list_events Read

List events for the current environment.

Lua path
app.integrations.workos.list_events
Full name
workos.workos_events_list
ParameterTypeRequiredDescription
No parameters.
list_feature_flags Read

Get a list of all of your existing feature flags matching the criteria specified.

Lua path
app.integrations.workos.list_feature_flags
Full name
workos.workos_feature_flags_list
ParameterTypeRequiredDescription
No parameters.
get_feature_flag Read

Get the details of an existing feature flag by its slug.

Lua path
app.integrations.workos.get_feature_flag
Full name
workos.workos_feature_flags_find_by_slug
ParameterTypeRequiredDescription
No parameters.
disable_feature_flag Write

Disables a feature flag in the current environment.

Lua path
app.integrations.workos.disable_feature_flag
Full name
workos.workos_feature_flags_disable_flag
ParameterTypeRequiredDescription
No parameters.
enable_feature_flag Write

Enables a feature flag in the current environment.

Lua path
app.integrations.workos.enable_feature_flag
Full name
workos.workos_feature_flags_enable_flag
ParameterTypeRequiredDescription
No parameters.
add_feature_flag_target Write

Enables a feature flag for a specific target in the current environment. Currently, supported targets include users and organizations.

Lua path
app.integrations.workos.add_feature_flag_target
Full name
workos.workos_flag_targets_create_target
ParameterTypeRequiredDescription
No parameters.
remove_feature_flag_target Write

Removes a target from the feature flag's target list in the current environment. Currently, supported targets include users and organizations.

Lua path
app.integrations.workos.remove_feature_flag_target
Full name
workos.workos_flag_targets_delete_target
ParameterTypeRequiredDescription
No parameters.
create_organization_domain Write

Creates a new Organization Domain.

Lua path
app.integrations.workos.create_organization_domain
Full name
workos.workos_organization_domains_create
ParameterTypeRequiredDescription
No parameters.
get_organization_domain Read

Get the details of an existing organization domain.

Lua path
app.integrations.workos.get_organization_domain
Full name
workos.workos_organization_domains_get
ParameterTypeRequiredDescription
No parameters.
delete_organization_domain Write

Permanently deletes an organization domain. It cannot be undone.

Lua path
app.integrations.workos.delete_organization_domain
Full name
workos.workos_organization_domains_delete
ParameterTypeRequiredDescription
No parameters.
verify_organization_domain Write

Initiates verification process for an Organization Domain.

Lua path
app.integrations.workos.verify_organization_domain
Full name
workos.workos_organization_domains_verify
ParameterTypeRequiredDescription
No parameters.
list_organizations Read

Get a list of all of your existing organizations matching the criteria specified.

Lua path
app.integrations.workos.list_organizations
Full name
workos.workos_organizations_list
ParameterTypeRequiredDescription
No parameters.
create_organization Write

Creates a new organization in the current environment.

Lua path
app.integrations.workos.create_organization
Full name
workos.workos_organizations_create
ParameterTypeRequiredDescription
No parameters.
get_organization_by_external_id Read

Get the details of an existing organization by an [external identifier](/authkit/metadata/external-identifiers).

Lua path
app.integrations.workos.get_organization_by_external_id
Full name
workos.workos_organizations_get_by_external_id
ParameterTypeRequiredDescription
No parameters.
get_organization Read

Get the details of an existing organization.

Lua path
app.integrations.workos.get_organization
Full name
workos.workos_organizations_find
ParameterTypeRequiredDescription
No parameters.
update_organization Write

Updates an organization in the current environment.

Lua path
app.integrations.workos.update_organization
Full name
workos.workos_organizations_update_organization
ParameterTypeRequiredDescription
No parameters.
delete_organization Write

Permanently deletes an organization in the current environment. It cannot be undone.

Lua path
app.integrations.workos.delete_organization
Full name
workos.workos_organizations_delete_organization
ParameterTypeRequiredDescription
No parameters.
get_audit_log_configuration Read

Get the unified view of audit log trail and stream configuration for an organization.

Lua path
app.integrations.workos.get_audit_log_configuration
Full name
workos.workos_organizations_get_audit_log_configuration
ParameterTypeRequiredDescription
No parameters.
get_retention Read

Get the configured event retention period for the given Organization.

Lua path
app.integrations.workos.get_retention
Full name
workos.workos_audit_logs_retention_audit_logs_retention
ParameterTypeRequiredDescription
No parameters.
set_retention Write

Set the event retention period for the given Organization.

Lua path
app.integrations.workos.set_retention
Full name
workos.workos_audit_logs_retention_update_audit_logs_retention
ParameterTypeRequiredDescription
No parameters.
list_api_keys_organization Read

Get a list of all API keys for an organization.

Lua path
app.integrations.workos.list_api_keys_organization
Full name
workos.workos_organization_api_keys_list
ParameterTypeRequiredDescription
No parameters.
create_api_key_organization Write

Create a new API key for an organization.

Lua path
app.integrations.workos.create_api_key_organization
Full name
workos.workos_organization_api_keys_create
ParameterTypeRequiredDescription
No parameters.
list_enabled_feature_flags_organization Read

Get a list of all enabled feature flags for an organization.

Lua path
app.integrations.workos.list_enabled_feature_flags_organization
Full name
workos.workos_organization_feature_flags_list
ParameterTypeRequiredDescription
No parameters.
create_group Write

Create a new group within an organization.

Lua path
app.integrations.workos.create_group
Full name
workos.workos_groups_create
ParameterTypeRequiredDescription
No parameters.
list_groups Read

Get a paginated list of groups within an organization.

Lua path
app.integrations.workos.list_groups
Full name
workos.workos_groups_list
ParameterTypeRequiredDescription
No parameters.
get_group Read

Retrieve a group by its ID within an organization.

Lua path
app.integrations.workos.get_group
Full name
workos.workos_groups_get
ParameterTypeRequiredDescription
No parameters.
update_group Write

Update an existing group. Only the fields provided in the request body will be updated.

Lua path
app.integrations.workos.update_group
Full name
workos.workos_groups_update
ParameterTypeRequiredDescription
No parameters.
delete_group Write

Delete a group from an organization.

Lua path
app.integrations.workos.delete_group
Full name
workos.workos_groups_delete
ParameterTypeRequiredDescription
No parameters.
add_member_group Write

Add an organization membership to a group.

Lua path
app.integrations.workos.add_member_group
Full name
workos.workos_group_memberships_add_member
ParameterTypeRequiredDescription
No parameters.
list_group_members Read

Get a list of organization memberships in a group.

Lua path
app.integrations.workos.list_group_members
Full name
workos.workos_group_memberships_list_members
ParameterTypeRequiredDescription
No parameters.
remove_member_from_group Write

Remove an organization membership from a group.

Lua path
app.integrations.workos.remove_member_from_group
Full name
workos.workos_group_memberships_remove_member
ParameterTypeRequiredDescription
No parameters.
create_attempt Write

Assess a request for risk using the Radar engine and receive a verdict.

Lua path
app.integrations.workos.create_attempt
Full name
workos.workos_radar_standalone_assess
ParameterTypeRequiredDescription
No parameters.
update_radar_attempt Write

You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts...

Lua path
app.integrations.workos.update_radar_attempt
Full name
workos.workos_radar_standalone_update_radar_attempt
ParameterTypeRequiredDescription
No parameters.
add_entry_radar_list Write

Add an entry to a Radar list.

Lua path
app.integrations.workos.add_entry_radar_list
Full name
workos.workos_radar_standalone_update_radar_list
ParameterTypeRequiredDescription
No parameters.
remove_entry_from_radar_list Write

Remove an entry from a Radar list.

Lua path
app.integrations.workos.remove_entry_from_radar_list
Full name
workos.workos_radar_standalone_delete_radar_list_entry
ParameterTypeRequiredDescription
No parameters.
initiate_sso Read

Initiates the single sign-on flow.

Lua path
app.integrations.workos.initiate_sso
Full name
workos.workos_sso_authorize
ParameterTypeRequiredDescription
No parameters.
get_jwks Read

Returns the JSON Web Key Set (JWKS) containing the public keys used for verifying access tokens.

Lua path
app.integrations.workos.get_jwks
Full name
workos.workos_sso_json_web_key_set
ParameterTypeRequiredDescription
No parameters.
logout_redirect Read

Logout allows to sign out a user from your application by triggering the identity provider sign out flow. This `GET` endpoint should be a redirection, since the identity provide...

Lua path
app.integrations.workos.logout_redirect
Full name
workos.workos_sso_logout
ParameterTypeRequiredDescription
No parameters.
logout_authorize Write

You should call this endpoint from your server to generate a logout token which is required for the [Logout Redirect](/reference/sso/logout) endpoint.

Lua path
app.integrations.workos.logout_authorize
Full name
workos.workos_sso_logout_authorize
ParameterTypeRequiredDescription
No parameters.
get_user_profile Read

Exchange an access token for a user's [Profile](/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](/reference/sso/profile/get-pr...

Lua path
app.integrations.workos.get_user_profile
Full name
workos.workos_sso_get_profile
ParameterTypeRequiredDescription
No parameters.
get_profile_and_token Write

Get an access token along with the user [Profile](/reference/sso/profile) using the code passed to your [Redirect URI](/reference/sso/get-authorization-url/redirect-uri).

Lua path
app.integrations.workos.get_profile_and_token
Full name
workos.workos_sso_token
ParameterTypeRequiredDescription
No parameters.
authenticate Write

Authenticate a user with a specified [authentication method](/reference/authkit/authentication).

Lua path
app.integrations.workos.authenticate
Full name
workos.workos_userland_sessions_authenticate_0
ParameterTypeRequiredDescription
No parameters.
get_authorization_url Read

Generates an OAuth 2.0 authorization URL to authenticate a user with AuthKit or SSO.

Lua path
app.integrations.workos.get_authorization_url
Full name
workos.workos_userland_sso_authorize
ParameterTypeRequiredDescription
No parameters.
get_device_authorization_url Write

Initiates the CLI Auth flow by requesting a device code and verification URLs. This endpoint implements the OAuth 2.0 Device Authorization Flow ([RFC 8628](https://datatracker.i...

Lua path
app.integrations.workos.get_device_authorization_url
Full name
workos.workos_userland_sso_device_authorization
ParameterTypeRequiredDescription
No parameters.
create_cors_origin Write

Creates a new CORS origin for the current environment. CORS origins allow browser-based applications to make requests to the WorkOS API.

Lua path
app.integrations.workos.create_cors_origin
Full name
workos.workos_cors_origins_create_cors_origin
ParameterTypeRequiredDescription
No parameters.
get_email_verification_code Read

Get the details of an existing email verification code that can be used to send an email to a user for verification.

Lua path
app.integrations.workos.get_email_verification_code
Full name
workos.workos_userland_users_get_email_verification
ParameterTypeRequiredDescription
No parameters.
list_invitations Write

Get a list of all of invitations matching the criteria specified.

Lua path
app.integrations.workos.list_invitations
Full name
workos.workos_userland_user_invites_list
ParameterTypeRequiredDescription
No parameters.
send_invitation Write

Sends an invitation email to the recipient.

Lua path
app.integrations.workos.send_invitation
Full name
workos.workos_userland_user_invites_create
ParameterTypeRequiredDescription
No parameters.
find_invitation_by_token Write

Retrieve an existing invitation using the token.

Lua path
app.integrations.workos.find_invitation_by_token
Full name
workos.workos_userland_user_invites_get_by_token
ParameterTypeRequiredDescription
No parameters.
get_invitation Write

Get the details of an existing invitation.

Lua path
app.integrations.workos.get_invitation
Full name
workos.workos_userland_user_invites_get
ParameterTypeRequiredDescription
No parameters.
accept_invitation Write

Accepts an invitation and, if linked to an organization, activates the user's membership in that organization.

Lua path
app.integrations.workos.accept_invitation
Full name
workos.workos_userland_user_invites_accept
ParameterTypeRequiredDescription
No parameters.
resend_invitation Write

Resends an invitation email to the recipient. The invitation must be in a pending state.

Lua path
app.integrations.workos.resend_invitation
Full name
workos.workos_userland_user_invites_resend
ParameterTypeRequiredDescription
No parameters.
revoke_invitation Write

Revokes an existing invitation.

Lua path
app.integrations.workos.revoke_invitation
Full name
workos.workos_userland_user_invites_revoke
ParameterTypeRequiredDescription
No parameters.
get_jwt_template Read

Get the JWT template for the current environment.

Lua path
app.integrations.workos.get_jwt_template
Full name
workos.workos_jwt_templates_get_jwt_template
ParameterTypeRequiredDescription
No parameters.
update_jwt_template Write

Update the JWT template for the current environment.

Lua path
app.integrations.workos.update_jwt_template
Full name
workos.workos_jwt_templates_update_jwt_template
ParameterTypeRequiredDescription
No parameters.
create_magic_auth_code Write

Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, [authenticate the user with Magic Auth](...

Lua path
app.integrations.workos.create_magic_auth_code
Full name
workos.workos_userland_magic_auth_send_magic_auth_code_and_return
ParameterTypeRequiredDescription
No parameters.
get_magic_auth_code_details Read

Get the details of an existing [Magic Auth](/reference/authkit/magic-auth) code that can be used to send an email to a user for authentication.

Lua path
app.integrations.workos.get_magic_auth_code_details
Full name
workos.workos_userland_magic_auth_get
ParameterTypeRequiredDescription
No parameters.
list_organization_memberships Read

Get a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships a...

Lua path
app.integrations.workos.list_organization_memberships
Full name
workos.workos_userland_user_organization_memberships_list
ParameterTypeRequiredDescription
No parameters.
create_organization_membership Write

Creates a new `active` organization membership for the given organization and user. Calling this API with an organization and user that match an `inactive` organization membersh...

Lua path
app.integrations.workos.create_organization_membership
Full name
workos.workos_userland_user_organization_memberships_create
ParameterTypeRequiredDescription
No parameters.
get_organization_membership Read

Get the details of an existing organization membership.

Lua path
app.integrations.workos.get_organization_membership
Full name
workos.workos_userland_user_organization_memberships_get
ParameterTypeRequiredDescription
No parameters.
delete_organization_membership Write

Permanently deletes an existing organization membership. It cannot be undone.

Lua path
app.integrations.workos.delete_organization_membership
Full name
workos.workos_userland_user_organization_memberships_delete
ParameterTypeRequiredDescription
No parameters.
update_organization_membership Write

Update the details of an existing organization membership.

Lua path
app.integrations.workos.update_organization_membership
Full name
workos.workos_userland_user_organization_memberships_update
ParameterTypeRequiredDescription
No parameters.
deactivate_organization_membership Write

Deactivates an `active` organization membership. Emits an [organization_membership.updated](/events/organization-membership) event upon successful deactivation. - Deactivating a...

Lua path
app.integrations.workos.deactivate_organization_membership
Full name
workos.workos_userland_user_organization_memberships_deactivate
ParameterTypeRequiredDescription
No parameters.
reactivate_organization_membership Write

Reactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](/events/organization-membership) event upon suc...

Lua path
app.integrations.workos.reactivate_organization_membership
Full name
workos.workos_userland_user_organization_memberships_reactivate
ParameterTypeRequiredDescription
No parameters.
list_groups Read

Get a list of groups that an organization membership belongs to.

Lua path
app.integrations.workos.list_groups
Full name
workos.workos_organization_membership_groups_list_groups
ParameterTypeRequiredDescription
No parameters.
create_password_reset_token Write

Creates a one-time token that can be used to reset a user's password.

Lua path
app.integrations.workos.create_password_reset_token
Full name
workos.workos_userland_users_create_password_reset_token
ParameterTypeRequiredDescription
No parameters.
reset_password Write

Sets a new password using the `token` query parameter from the link that the user received. Successfully resetting the password will verify a user's email, if it hasn't been ver...

Lua path
app.integrations.workos.reset_password
Full name
workos.workos_userland_users_reset_password_0
ParameterTypeRequiredDescription
No parameters.
get_password_reset_token Write

Get the details of an existing password reset token that can be used to reset a user's password.

Lua path
app.integrations.workos.get_password_reset_token
Full name
workos.workos_userland_users_get_password_reset
ParameterTypeRequiredDescription
No parameters.
create_redirect_uri Write

Creates a new redirect URI for an environment.

Lua path
app.integrations.workos.create_redirect_uri
Full name
workos.workos_redirect_uris_create
ParameterTypeRequiredDescription
No parameters.
logout Read

Logout a user from the current [session](/reference/authkit/session).

Lua path
app.integrations.workos.logout
Full name
workos.workos_userland_sessions_logout
ParameterTypeRequiredDescription
No parameters.
revoke_session Write

Revoke a [user session](/reference/authkit/session).

Lua path
app.integrations.workos.revoke_session
Full name
workos.workos_userland_sessions_revoke_session
ParameterTypeRequiredDescription
No parameters.
list_users Read

Get a list of all of your existing users matching the criteria specified.

Lua path
app.integrations.workos.list_users
Full name
workos.workos_userland_users_list_0
ParameterTypeRequiredDescription
No parameters.
create_user Write

Create a new user in the current environment.

Lua path
app.integrations.workos.create_user
Full name
workos.workos_userland_users_create_0
ParameterTypeRequiredDescription
No parameters.
get_user_by_external_id Read

Get the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers).

Lua path
app.integrations.workos.get_user_by_external_id
Full name
workos.workos_userland_users_get_by_external_id
ParameterTypeRequiredDescription
No parameters.
update_user Write

Updates properties of a user. The omitted properties will be left unchanged.

Lua path
app.integrations.workos.update_user
Full name
workos.workos_userland_users_update_0
ParameterTypeRequiredDescription
No parameters.
get_user Read

Get the details of an existing user.

Lua path
app.integrations.workos.get_user
Full name
workos.workos_userland_users_get_0
ParameterTypeRequiredDescription
No parameters.
delete_user Write

Permanently deletes a user in the current environment. It cannot be undone.

Lua path
app.integrations.workos.delete_user
Full name
workos.workos_userland_users_delete_0
ParameterTypeRequiredDescription
No parameters.
confirm_email_change Write

Confirms an email change using the one-time code received by the user.

Lua path
app.integrations.workos.confirm_email_change
Full name
workos.workos_userland_users_confirm_email_change
ParameterTypeRequiredDescription
No parameters.
send_email_change_code Write

Sends an email that contains a one-time code used to change a user's email address.

Lua path
app.integrations.workos.send_email_change_code
Full name
workos.workos_userland_users_send_email_change
ParameterTypeRequiredDescription
No parameters.
verify_email Write

Verifies an email address using the one-time code received by the user.

Lua path
app.integrations.workos.verify_email
Full name
workos.workos_userland_users_email_verification_0
ParameterTypeRequiredDescription
No parameters.
send_verification_email Write

Sends an email that contains a one-time code used to verify a user’s email address.

Lua path
app.integrations.workos.send_verification_email
Full name
workos.workos_userland_users_send_verification_email_0
ParameterTypeRequiredDescription
No parameters.
get_user_identities Read

Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](/authkit/identity-linking). Currently on...

Lua path
app.integrations.workos.get_user_identities
Full name
workos.workos_userland_user_identities_get
ParameterTypeRequiredDescription
No parameters.
list_sessions Read

Get a list of all active sessions for a specific user.

Lua path
app.integrations.workos.list_sessions
Full name
workos.workos_userland_user_sessions_list
ParameterTypeRequiredDescription
No parameters.
list_api_keys_user Read

Get a list of API keys owned by a specific user.

Lua path
app.integrations.workos.list_api_keys_user
Full name
workos.workos_user_api_keys_list
ParameterTypeRequiredDescription
No parameters.
create_api_key_user Write

Create a new API key owned by a user. The user must have an active membership in the specified organization.

Lua path
app.integrations.workos.create_api_key_user
Full name
workos.workos_user_api_keys_create
ParameterTypeRequiredDescription
No parameters.
list_enabled_feature_flags_user Read

Get a list of all enabled feature flags for the provided user. This includes feature flags enabled specifically for the user as well as any organizations that the user is a memb...

Lua path
app.integrations.workos.list_enabled_feature_flags_user
Full name
workos.workos_userland_user_feature_flags_list
ParameterTypeRequiredDescription
No parameters.
list_authorized_applications Read

Get a list of all Connect applications that the user has authorized.

Lua path
app.integrations.workos.list_authorized_applications
Full name
workos.workos_authorized_applications_list
ParameterTypeRequiredDescription
No parameters.
delete_authorized_application Write

Delete an existing Authorized Connect Application.

Lua path
app.integrations.workos.delete_authorized_application
Full name
workos.workos_authorized_applications_delete
ParameterTypeRequiredDescription
No parameters.
get_connected_account Read

Retrieves a user's [connected account](/reference/pipes/connected-account) for a specific provider.

Lua path
app.integrations.workos.get_connected_account
Full name
workos.workos_data_integrations_user_management_get_user_data_installation
ParameterTypeRequiredDescription
No parameters.
delete_connected_account Write

Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not re...

Lua path
app.integrations.workos.delete_connected_account
Full name
workos.workos_data_integrations_user_management_delete_user_data_installation
ParameterTypeRequiredDescription
No parameters.
list_providers Read

Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected accoun...

Lua path
app.integrations.workos.list_providers
Full name
workos.workos_data_integrations_user_management_get_user_data_integrations
ParameterTypeRequiredDescription
No parameters.
enroll_authentication_factor Write

Enrolls a user in a new [authentication factor](/reference/authkit/mfa/authentication-factor).

Lua path
app.integrations.workos.enroll_authentication_factor
Full name
workos.workos_userland_user_authentication_factors_create_0
ParameterTypeRequiredDescription
No parameters.
list_authentication_factors Read

Lists the [authentication factors](/reference/authkit/mfa/authentication-factor) for a user.

Lua path
app.integrations.workos.list_authentication_factors
Full name
workos.workos_userland_user_authentication_factors_list_0
ParameterTypeRequiredDescription
No parameters.
list_webhook_endpoints Read

Get a list of all of your existing webhook endpoints.

Lua path
app.integrations.workos.list_webhook_endpoints
Full name
workos.workos_webhook_endpoints_list
ParameterTypeRequiredDescription
No parameters.
create_webhook_endpoint Write

Create a new webhook endpoint to receive event notifications.

Lua path
app.integrations.workos.create_webhook_endpoint
Full name
workos.workos_webhook_endpoints_create
ParameterTypeRequiredDescription
No parameters.
update_webhook_endpoint Write

Update the properties of an existing webhook endpoint.

Lua path
app.integrations.workos.update_webhook_endpoint
Full name
workos.workos_webhook_endpoints_update
ParameterTypeRequiredDescription
No parameters.
delete_webhook_endpoint Write

Delete an existing webhook endpoint.

Lua path
app.integrations.workos.delete_webhook_endpoint
Full name
workos.workos_webhook_endpoints_delete
ParameterTypeRequiredDescription
No parameters.
generate_widget_token Write

Generate a widget token scoped to an organization and user with the specified scopes.

Lua path
app.integrations.workos.generate_widget_token
Full name
workos.workos_widgets_public_issue_widget_session_token
ParameterTypeRequiredDescription
No parameters.