<!-- llms.txt: https://workos.com/llms.txt -->

# Resource

A resource is an instance of a [resource type](https://workos.com/docs/fga/resource-types) that represents an entity in your application. Resources can be workspaces, projects, apps, or any other object that users can access.

Resources are organized in a hierarchy. When a role is assigned to a user on a parent resource, they automatically gain access to child resources through permission inheritance.

## Create a resource

Create a new authorization resource. The resource is associated with an organization and resource type.

You can optionally specify a parent resource to place it in a hierarchy. The parent can be identified either by `parent_resource_id` or by the combination of `parent_resource_external_id` and `parent_resource_type_slug`.

> **Note:** The `external_id` must be unique within the organization and resource type
> combination.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request POST \
  --url "https://api.workos.com/authorization/resources" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "external_id": "my-workspace-01",
        "name": "Acme Workspace",
        "resource_type_slug": "workspace",
        "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

// Option 1: by parent resource ID
const resource = await workos.authorization.createResource({
  organizationId: 'org_01ABC123',
  resourceTypeSlug: 'project',
  externalId: 'proj-456',
  name: 'Website Redesign',
  description: 'Company website redesign project',
  parentResourceId: 'authz_resource_01XYZ789',
});

// Option 2: by parent external ID + type
const resourceByExternal = await workos.authorization.createResource({
  organizationId: 'org_01ABC123',
  resourceTypeSlug: 'project',
  externalId: 'proj-789',
  name: 'Mobile App',
  parentResourceExternalId: 'ws-123',
  parentResourceTypeSlug: 'workspace',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.create_resource(
  external_id: "my-workspace-01",
  name: "Acme Workspace",
  resource_type_slug: "workspace",
  organization_id: "org_01EHQMYV6MBK39QC5PZXHY59C3"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.create_resource(
    external_id="my-workspace-01",
    name="Acme Workspace",
    resource_type_slug="workspace",
    organization_id="org_01EHQMYV6MBK39QC5PZXHY59C3",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().CreateResource(context.Background(), &workos.AuthorizationCreateResourceParams{
		ExternalID:       "my-workspace-01",
		Name:             "Acme Workspace",
		ResourceTypeSlug: "workspace",
		OrganizationID:   "org_01EHQMYV6MBK39QC5PZXHY59C3",
	})
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->createResource(
        externalId: "my-workspace-01",
        name: "Acme Workspace",
        resourceTypeSlug: "workspace",
        organizationId: "org_01EHQMYV6MBK39QC5PZXHY59C3",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;
import com.workos.authorization.AuthorizationApi.CreateResourceOptions;

WorkOS workos = new WorkOS("sk_example_123456789");

CreateResourceOptions options = CreateResourceOptions.builder()
                                    .externalId("my-workspace-01")
                                    .name("Acme Workspace")
                                    .resourceTypeSlug("workspace")
                                    .organizationId("org_01EHQMYV6MBK39QC5PZXHY59C3")
                                    .build();

workos.authorization.createResource(options);
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.CreateResourceAsync(new AuthorizationCreateResourceOptions {
    ExternalId = "my-workspace-01",
    Name = "Acme Workspace",
    ResourceTypeSlug = "workspace",
    OrganizationId = "org_01EHQMYV6MBK39QC5PZXHY59C3",
});
```

```rust language="rust" title="Request" tab="1"
use workos::Client;
use workos::authorization::CreateResourceParams;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .create_resource(
            CreateResourceParams {
                external_id: "my-workspace-01".into(),
                name: "Acme Workspace".into(),
                resource_type_slug: "workspace".into(),
                organization_id: "org_01EHQMYV6MBK39QC5PZXHY59C3".into(),
                ..Default::default()
            }
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authorization_resource",
  "name": "Acme Workspace",
  "description": "Primary workspace for the Acme team",
  "organization_id": "org_01EHQMYV6MBK39QC5PZXHY59C3",
  "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
  "id": "authz_resource_01HXYZ123456789ABCDEFGH",
  "external_id": "my-workspace-01",
  "resource_type_slug": "workspace",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Delete a resource by external ID

Delete an authorization resource using its external ID. By default, this will fail if the resource has child resources or role assignments. Set `cascade_delete` to `true` to delete the resource along with all its descendants and role assignments.

> **Note:** Deleting a resource also removes all role assignments on that resource. This
> action cannot be undone.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request DELETE \
  --url "https://api.workos.com/authorization/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/resources/project/proj-456" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.authorization.deleteResourceByExternalId({
  organizationId: 'org_01ABC123',
  resourceTypeSlug: 'project',
  externalId: 'proj-456',
  cascadeDelete: true,
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.delete_resource_by_external_id(
  organization_id: "org_01EHZNVPK3SFK441A1RGBFSHRT",
  resource_type_slug: "project",
  external_id: "proj-456"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.delete_resource_by_external_id(
    organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT",
    resource_type_slug="project",
    external_id="proj-456",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().DeleteResourceByExternalID(context.Background(), "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->deleteResourceByExternalId(
        organizationId: "org_01EHZNVPK3SFK441A1RGBFSHRT",
        resourceTypeSlug: "project",
        externalId: "proj-456",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.deleteResourceByExternalId(
    "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.DeleteResourceByExternalIdAsync("org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .delete_resource_by_external_id(
            "org_01EHZNVPK3SFK441A1RGBFSHRT",
            "project",
            "proj-456"
        )
        .await?;

    Ok(())
}
```

:::

## Delete a resource

Delete an authorization resource. By default, this will fail if the resource has child resources or role assignments. Set `cascade_delete` to `true` to delete the resource along with all its descendants and role assignments.

> **Note:** Deleting a resource also removes all role assignments on that resource. This
> action cannot be undone.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request DELETE \
  --url "https://api.workos.com/authorization/resources/authz_resource_01HXYZ123456789ABCDEFGHIJ" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

await workos.authorization.deleteResource({
  resourceId: 'authz_resource_01HXYZ123456789ABCDEFGH',
  cascadeDelete: true,
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.delete_resource(resource_id: "authz_resource_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.delete_resource(
    resource_id="authz_resource_01HXYZ123456789ABCDEFGHIJ"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().DeleteResource(context.Background(), "authz_resource_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->deleteResource(resourceId: "authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.deleteResource("authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.DeleteResourceAsync("authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .delete_resource("authz_resource_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

:::

## Get a resource by external ID

Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/resources/project/proj-456" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const resource = await workos.authorization.getResourceByExternalId({
  organizationId: 'org_01ABC123',
  resourceTypeSlug: 'project',
  externalId: 'proj-456',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.get_resource_by_external_id(
  organization_id: "org_01EHZNVPK3SFK441A1RGBFSHRT",
  resource_type_slug: "project",
  external_id: "proj-456"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.get_resource_by_external_id(
    organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT",
    resource_type_slug="project",
    external_id="proj-456",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().GetResourceByExternalID(context.Background(), "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->getResourceByExternalId(
        organizationId: "org_01EHZNVPK3SFK441A1RGBFSHRT",
        resourceTypeSlug: "project",
        externalId: "proj-456",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.getResourceByExternalId(
    "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.GetResourceByExternalIdAsync("org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .get_resource_by_external_id(
            "org_01EHZNVPK3SFK441A1RGBFSHRT",
            "project",
            "proj-456"
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authorization_resource",
  "name": "Website Redesign",
  "description": "Company website redesign project",
  "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
  "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
  "id": "authz_resource_01HXYZ123456789ABCDEFGH",
  "external_id": "proj-456",
  "resource_type_slug": "project",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Get a resource

Retrieve the details of an authorization resource by its ID.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/resources/authz_resource_01HXYZ123456789ABCDEFGHIJ" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const resource = await workos.authorization.getResource(
  'authz_resource_01HXYZ123456789ABCDEFGH',
);
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.get_resource(resource_id: "authz_resource_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.get_resource(
    resource_id="authz_resource_01HXYZ123456789ABCDEFGHIJ"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().GetResource(context.Background(), "authz_resource_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->getResource(resourceId: "authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.getResource("authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.GetResourceAsync("authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .get_resource("authz_resource_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authorization_resource",
  "name": "Website Redesign",
  "description": "Company website redesign project",
  "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
  "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
  "id": "authz_resource_01HXYZ123456789ABCDEFGH",
  "external_id": "proj-456",
  "resource_type_slug": "project",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## List resources

Get a paginated list of authorization resources.

:::code-group

```bash language="curl" title="Request" tab="1"
curl "https://api.workos.com/authorization/resources" \
  --header "Authorization: Bearer sk_example_123456789"
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const resources = await workos.authorization.listResources({
  organizationId: 'org_01ABC123',
  resourceTypeSlug: 'project',
  parentResourceId: 'authz_resource_01XYZ789',
  search: 'budget',
  limit: 10,
  order: 'desc',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.list_resources
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.list_resources()
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().ListResources(context.Background())
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos->authorization()->listResources();
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.listResources();
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.ListResourcesAsync();
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .list_resources()
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "list",
  "data": [
    {
      "object": "authorization_resource",
      "name": "Website Redesign",
      "description": "Company website redesign project",
      "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
      "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
      "id": "authz_resource_01HXYZ123456789ABCDEFGH",
      "external_id": "proj-456",
      "resource_type_slug": "project",
      "created_at": "2026-01-15T12:00:00.000Z",
      "updated_at": "2026-01-15T12:00:00.000Z"
    }
  ],
  "list_metadata": {
    "before": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
    "after": "authz_resource_01HXYZ987654321KJIHGFEDCBA"
  }
}
```

:::

## Update a resource by external ID

Update an existing authorization resource using its external ID.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request PATCH \
  --url "https://api.workos.com/authorization/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/resources/project/proj-456" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "name": "Updated Name",
        "description": "Updated description",
        "parent_resource_external_id": "parent-workspace-01",
        "parent_resource_type_slug": "workspace"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const resource = await workos.authorization.updateResourceByExternalId({
  organizationId: 'org_01ABC123',
  resourceTypeSlug: 'project',
  externalId: 'proj-456',
  name: 'Updated Name',
  description: 'Updated description',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.update_resource_by_external_id(
  organization_id: "org_01EHZNVPK3SFK441A1RGBFSHRT",
  resource_type_slug: "project",
  external_id: "proj-456"
)
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.update_resource_by_external_id(
    organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT",
    resource_type_slug="project",
    external_id="proj-456",
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().UpdateResourceByExternalID(context.Background(), "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->updateResourceByExternalId(
        organizationId: "org_01EHZNVPK3SFK441A1RGBFSHRT",
        resourceTypeSlug: "project",
        externalId: "proj-456",
    );
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.updateResourceByExternalId(
    "org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.UpdateResourceByExternalIdAsync("org_01EHZNVPK3SFK441A1RGBFSHRT", "project", "proj-456");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .update_resource_by_external_id(
            "org_01EHZNVPK3SFK441A1RGBFSHRT",
            "project",
            "proj-456"
        )
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authorization_resource",
  "name": "Updated Name",
  "description": "Updated description",
  "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
  "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
  "id": "authz_resource_01HXYZ123456789ABCDEFGH",
  "external_id": "proj-456",
  "resource_type_slug": "project",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

## Update a resource

Update an existing authorization resource.

:::code-group

```bash language="curl" title="Request" tab="1"
curl --request PATCH \
  --url "https://api.workos.com/authorization/resources/authz_resource_01HXYZ123456789ABCDEFGHIJ" \
  --header "Authorization: Bearer sk_example_123456789" \
  --header "Content-Type: application/json" \
  -d @- <<'BODY'
    {
        "name": "Updated Name",
        "description": "Updated description",
        "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ"
    }
BODY
```

```js language="js" title="Request" tab="1"
import { WorkOS } from '@workos-inc/node';

const workos = new WorkOS('sk_example_123456789');

const resource = await workos.authorization.updateResource({
  resourceId: 'authz_resource_01HXYZ123456789ABCDEFGH',
  name: 'Updated Name',
  description: 'Updated description',
});
```

```rb language="ruby" title="Request" tab="1"
require "workos"

WorkOS.configure do |config|
  config.api_key = "sk_example_123456789"
end

WorkOS.client.authorization.update_resource(resource_id: "authz_resource_01HXYZ123456789ABCDEFGHIJ")
```

```py language="python" title="Request" tab="1"
from workos import WorkOSClient

client = WorkOSClient(api_key="sk_example_123456789", client_id="client_123456789")

client.authorization.update_resource(
    resource_id="authz_resource_01HXYZ123456789ABCDEFGHIJ"
)
```

```go language="go" title="Request" tab="1"
package main

import (
	"context"

	"github.com/workos/workos-go/v10"
)

func main() {
	client := workos.NewClient("sk_example_123456789")

	_, err := client.Authorization().UpdateResource(context.Background(), "authz_resource_01HXYZ123456789ABCDEFGHIJ")
	if err != nil {
		panic(err)
	}
}
```

```php language="php" title="Request" tab="1"
<?php

use WorkOS\WorkOS;

$workos = new WorkOS(
    apiKey: "sk_example_123456789",
    clientId: "client_123456789",
);

$workos
    ->authorization()
    ->updateResource(resourceId: "authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```java language="java" title="Request" tab="1"
import com.workos.WorkOS;

WorkOS workos = new WorkOS("sk_example_123456789");

workos.authorization.updateResource("authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```cs language="dotnet" title="Request" tab="1"
using WorkOS;

var client = new WorkOSClient(new WorkOSOptions {
    ApiKey = "sk_example_123456789",
    ClientId = "client_123456789",
});

await client.Authorization.UpdateResourceAsync("authz_resource_01HXYZ123456789ABCDEFGHIJ");
```

```rust language="rust" title="Request" tab="1"
use workos::Client;

#[tokio::main]
async fn main() -> Result<(), workos::Error> {
    let client = Client::builder()
        .api_key("sk_example_123456789")
        .client_id("client_123456789")
        .build();

    let _result = client
        .authorization()
        .update_resource("authz_resource_01HXYZ123456789ABCDEFGHIJ")
        .await?;

    Ok(())
}
```

```json language="json" title="Response" tab="2"
{
  "object": "authorization_resource",
  "name": "Updated Name",
  "description": "Updated description",
  "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT",
  "parent_resource_id": "authz_resource_01HXYZ123456789ABCDEFGHIJ",
  "id": "authz_resource_01HXYZ123456789ABCDEFGH",
  "external_id": "proj-456",
  "resource_type_slug": "project",
  "created_at": "2026-01-15T12:00:00.000Z",
  "updated_at": "2026-01-15T12:00:00.000Z"
}
```

:::

### Resource

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `object` | "authorization_resource" | Yes | Distinguishes the Resource object. |
| `id` | string | Yes | Unique identifier of the Resource. |
| `external_id` | string | Yes | An identifier you provide to reference the resource in your system. |
| `name` | string | Yes | A human-readable name for the Resource. |
| `description` | string \| null | Yes | An optional description for the Resource. |
| `resource_type_slug` | string | Yes | The slug of the resource type this resource belongs to. |
| `parent_resource_id` | string \| null | Yes | The ID of the parent resource in the hierarchy, if any. |
| `organization_id` | string | Yes | The ID of the organization this resource belongs to. |
| `created_at` | string | Yes | The timestamp when the Resource was created. |
| `updated_at` | string | Yes | The timestamp when the Resource was last updated. |

### POST /authorization/resources

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `external_id` | string | Yes | An identifier you provide to reference the resource in your system. Must be unique within the organization and resource type. |
| `name` | string | Yes | A human-readable name for the resource. |
| `description` | string | No | An optional description for the resource. |
| `resource_type_slug` | string | Yes | The slug of the resource type this resource belongs to. |
| `organization_id` | string | Yes | The ID of the organization this resource belongs to. |
| `parent_resource_id` | string | No | The ID of the parent resource. Use either this or parent_resource_external_id + parent_resource_type_slug. |
| `parent_resource_external_id` | string | No | The external ID of the parent resource. Requires parent_resource_type_slug. |
| `parent_resource_type_slug` | string | No | The resource type slug of the parent resource. Required with parent_resource_external_id. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authorization_resource` | object | Distinguishes the Resource object. |

### DELETE /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_id` | string | Yes | The ID of the organization. |
| `resource_type_slug` | string | Yes | The slug of the resource type. |
| `external_id` | string | Yes | The external ID of the resource. |
| `cascade_delete` | boolean | No | If true, deletes all descendant resources and role assignments. Defaults to false. If not set and the resource has children or assignments, the request will fail. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### DELETE /authorization/resources/{resource_id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `resource_id` | string | Yes | The ID of the resource to delete. |
| `cascade_delete` | boolean | No | If true, deletes all descendant resources and role assignments. Defaults to false. If not set and the resource has children or assignments, the request will fail. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `empty` | empty | Returns an empty response on success. |

### GET /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_id` | string | Yes | The ID of the organization. |
| `resource_type_slug` | string | Yes | The slug of the resource type. |
| `external_id` | string | Yes | The external ID of the resource. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authorization_resource` | object | Distinguishes the Resource object. |

### GET /authorization/resources/{resource_id}

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `resource_id` | string | Yes | The ID of the resource to retrieve. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authorization_resource` | object | Distinguishes the Resource object. |

### GET /authorization/resources

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `before` | string | No | Cursor for pagination (before). |
| `after` | string | No | Cursor for pagination (after). |
| `limit` | integer | No | Maximum number of records to return (default 10, max 100). |
| `order` | "normal" \| "desc" \| "asc" | No | Sort order (asc or desc). |
| `organization_id` | string | No | Filter resources by organization ID. |
| `resource_type_slug` | string | No | Filter resources by resource type slug. |
| `resource_external_id` | string | No | Filter resources by external ID. |
| `parent_resource_id` | string | No | Filter resources by parent resource ID. |
| `parent_resource_type_slug` | string | No | Filter resources by parent resource type slug. |
| `parent_external_id` | string | No | Filter resources by parent external ID. |

### PATCH /authorization/organizations/{organization_id}/resources/{resource_type_slug}/{external_id}

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | No | The new name for the resource. |
| `description` | string | No | The new description for the resource. Pass null to remove the description. |
| `parent_resource_id` | string | No | The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`. |
| `parent_resource_external_id` | string | No | The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. |
| `parent_resource_type_slug` | string | No | The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`. |

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `organization_id` | string | Yes | The ID of the organization. |
| `resource_type_slug` | string | Yes | The slug of the resource type. |
| `external_id` | string | Yes | The external ID of the resource. |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authorization_resource` | object | Distinguishes the Resource object. |

### PATCH /authorization/resources/{resource_id}

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| `name` | string | No | The new name for the resource. |
| `description` | string | No | The new description for the resource. Pass null to remove the description. |
| `parent_resource_id` | string | No | The ID of the parent resource. Mutually exclusive with `parent_resource_external_id` and `parent_resource_type_slug`. |
| `parent_resource_external_id` | string | No | The external ID of the parent resource. Required with `parent_resource_type_slug`. Mutually exclusive with `parent_resource_id`. |
| `parent_resource_type_slug` | string | No | The resource type slug of the parent resource. Required with `parent_resource_external_id`. Mutually exclusive with `parent_resource_id`. |

#### Parameters

| Parameter | Type | Required | Description |
| --- | --- | --- | --- |
| `resource_id` | string | Yes | The ID of the resource to update (path parameter). |

#### Returns

| Field | Type | Description |
| --- | --- | --- |
| `authorization_resource` | object | Distinguishes the Resource object. |