# AuthKit AuthKit is a user management platform that provides a set of user authentication and organization security features designed to provide a fast, scalable integration while handling all of the user management complexity that comes with advanced B2B customer needs. To automatically respond to AuthKit activities, like authentication and changes related to the users, use the corresponding [events](https://workos.com/docs/events). ## Create a CORS origin Creates a new CORS origin for the current environment. CORS origins allow browser-based applications to make requests to the WorkOS API. #### Request #### Response ## Import a connected account Imports a [connected account](https://workos.com/docs/reference/pipes/connected-account) for a user by providing OAuth tokens directly. Use this to migrate existing connections or set up connections without going through the OAuth flow. #### Request #### Response ## Create a redirect URI Creates a new redirect URI for an application. #### Request #### Response ## Get Radar Challenge details Get the details of an existing Radar Challenge, including the OTP code. #### Request #### Response ## List CORS origins Lists the CORS origins for the current environment. #### Request #### Response ## List redirect URIs Lists the redirect URIs for an environment. #### Request #### Response ## Send a Radar SMS challenge Sends a one-time verification code over SMS to a user as part of a Radar challenge. Use the returned `verification_id` to authenticate the user with the `urn:workos:oauth:grant-type:radar-sms-challenge:code` grant type. > **Note:** Radar in the User Management APIs is currently in preview, [contact us](mailto:support@workos.com) to request access. #### Request #### Response ## Update a connected account Updates a user's [connected account](https://workos.com/docs/reference/pipes/connected-account) tokens, scopes, or state for a specific provider. #### Request #### Response ### /user_management/cors_origins | Field | Type | Required | Description | | --- | --- | --- | --- | | `origin` | string | Yes | The origin URL to allow for CORS requests. | ### POST /user_management/users/{user_id}/connected_accounts/{slug} #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `user_id` | string | Yes | A [User](/reference/authkit/user) identifier. | | `slug` | string | Yes | The slug identifier of the provider (e.g., `github`, `slack`, `notion`). | | `organization_id` | string | No | An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. | #### Returns | Field | Type | Description | | --- | --- | --- | | `connected_account` | object | Distinguishes the connected account object. | ### /user_management/redirect_uris | Field | Type | Required | Description | | --- | --- | --- | --- | | `uri` | string | Yes | The redirect URI to create. | ### GET /user_management/radar_challenges/{id} #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `id` | string | Yes | The unique ID of the Radar Challenge. | #### Returns | Field | Type | Description | | --- | --- | --- | | `radar_challenge` | object | Distinguishes the Radar Challenge object. | ### GET /user_management/cors_origins #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `before` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. | | `after` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. | | `limit` | integer | No | Upper limit on the number of objects to return, between `1` and `100`. Defaults to `10`. | | `order` | "normal" \| "desc" \| "asc" | No | Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. | ### GET /user_management/redirect_uris #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `before` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `before="obj_123"` to fetch a new batch of objects before `"obj_123"`. | | `after` | string | No | An object ID that defines your place in the list. When the ID is not present, you are at the end of the list. For example, if you make a list request and receive 100 objects, ending with `"obj_123"`, your subsequent call can include `after="obj_123"` to fetch a new batch of objects after `"obj_123"`. | | `limit` | integer | No | Upper limit on the number of objects to return, between `1` and `100`. Defaults to `10`. | | `order` | "normal" \| "desc" \| "asc" | No | Order the results by the creation time. Supported values are `"asc"` (ascending), `"desc"` (descending), and `"normal"` (descending with reversed cursor semantics where `before` fetches older records and `after` fetches newer records). Defaults to `desc`. | ### /user_management/radar_challenges | Field | Type | Required | Description | | --- | --- | --- | --- | | `user_id` | string | Yes | The ID of the user to send the SMS challenge to. | | `pending_authentication_token` | string | Yes | The pending authentication token from a previous authentication attempt that triggered the Radar challenge. | | `phone_number` | string | Yes | The phone number to send the SMS verification code to. | | `ip_address` | string | No | The IP address of the user's request. | | `user_agent` | string | No | The user agent string from the user's request. | ### PUT /user_management/users/{user_id}/connected_accounts/{slug} #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `user_id` | string | Yes | A [User](/reference/authkit/user) identifier. | | `slug` | string | Yes | The slug identifier of the provider (e.g., `github`, `slack`, `notion`). | | `organization_id` | string | No | An [Organization](/reference/organization) identifier. Optional parameter if the connection is scoped to an organization. | #### Returns | Field | Type | Description | | --- | --- | --- | | `connected_account` | object | Distinguishes the connected account object. |