The WorkOS API enables adding Enterprise Ready features to your application. This REST API provides programmatic access to AuthKit (user management), Single Sign-On, Directory Sync, and Audit Log resources.
Sign in to see code examples customized with your API keys and data.
https://api.workos.com
WorkOS offers native SDKs in several popular programming languages. Choose one language below to see our API Reference in your application’s language.
Don't see an SDK you need? Contact us to request an SDK!
You can test the API directly with cURL, or use the Postman collection for convenience.
Check out the guide about the WorkOS API Postman collection to learn more about it.
WorkOS authenticates your API requests using your account’s API keys. API requests made without authentication or using an incorrect key will return a 401 error. Requests using a valid key but with insufficient permissions will return a 403 error. All API requests must be made over HTTPS. Any requests made over plain HTTP will fail.
curl https://api.workos.com/directories \ --header "Authorization: Bearer sk_example_123456789"
You can view and manage your API keys in the WorkOS Dashboard.
API keys can perform any API request to WorkOS. They should be kept secure and private! Be sure to prevent API keys from being made publicly accessible, such as in client-side code, GitHub, unsecured S3 buckets, and so forth. API keys are prefixed with sk_.
Your Staging Environment comes with an API key already generated for you. Staging API keys may be viewed as often as they are needed and will appear inline throughout our documentation in code examples if you are logged in to your WorkOS account. API requests will be scoped to the provided key’s Environment.
Once you unlock Production access you will need to generate an API Key for it. Production API keys may only be viewed once and will need to be saved in a secure location upon creation of them.
WorkOS uses standard HTTP response codes to indicate the success or failure of your API requests.
2004004014034044224295xxMany top-level resources have support for bulk fetches via list API methods. For instance, you can list connections, list directory users, and list directory groups. These list API methods share a common structure, taking at least these four parameters: limit, order, after, and before.
WorkOS utilizes pagination via the after and before parameters. Both parameters take an existing object ID value and return objects in either descending or ascending order by creation time.
curl https://api.workos.com/connections?limit=100 \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "object": "connection", "id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "connection_type": "GoogleOAuth", "name": "Foo Corp", "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:08:33.155Z" }, { "object": "connection", "id": "conn_01E2NPPCT7XQ2MVVYDHWGK1WN4", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "connection_type": "OktaSAML", "name": "Example Co", "state": "active", "created_at": "2021-06-25T19:09:33.155Z", "updated_at": "2021-06-25T19:10:33.155Z" } ], "list_metadata": { "before": "conn_01E2NPPCT7XQ2MVVYDHWGK1WN4", "after": null } }
Parameters The WorkOS API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource.
To achieve idempotency, you can add Idempotency-Key request header to any WorkOS API request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using v4 UUIDs for idempotency keys to avoid collisions.
curl --request POST \ --url https://api.workos.com/organizations \ -H "Authorization: Bearer sk_example_123456789" \ -H "Idempotency-Key: cd320c5c-e928-4212-a5bd-986c29362867" \ -d 'name="Foo Corp"' \ -d 'domains[]="foo-corp.com"'
Idempotency keys expire after 24 hours. The WorkOS API will generate a new response if you submit a request with an expired key.
WorkOS APIs are rate limited to ensure that they are fast for everyone. If you find yourself getting 429 errors, double check your integration to make sure you aren’t making unnecessary requests.
| Name | Path | Limit |
|---|---|---|
| All requests | * | 6,000 requests per 60 seconds per IP address |
This rate limits applies to all environments, staging and production. Exceptions to the general rate limit are listed below.
| Name | Path | Limit |
|---|---|---|
| Get Authorization URL | /sso/authorize | 1,000 requests per 60 seconds per connection |
| Name | Path | Limit |
|---|---|---|
| Directory Users | /directory_users | 4 requests per second per directory |
Rate limiting for AuthKit APIs are enforced on an account basis.
| Name | Path | Limit |
|---|---|---|
| Reads | /user_management/* | 1,000 requests per 10 seconds |
| Writes | /user_management/* | 500 requests per 10 seconds |
| Authentication | /user_management/authenticate | 10 requests per 60 seconds per email or challenge ID |
| Magic Auth | /user_management/magic_auth/send | 3 requests per 60 seconds per email |
| Email verification | /user_management/:id/email_verification/send | 3 requests per 60 seconds per user |
| Password reset | /user_management/password_reset/send | 3 requests per 60 seconds per email |
| Name | Limits |
|---|---|
| Reads | 1,000 requests per 10 seconds |
| Writes | 500 requests per 10 seconds |
| SSO sign-ins | 3 requests per 60 seconds per IP address |
| Email sign-ins | 10 requests per 60 seconds per email and IP address |
| Magic Auth sign-ins | 10 requests per 60 seconds per IP address and challenge ID |
| Magic Auth code requests | 3 requests per 60 seconds per IP address and email |
Events represent activity that has occurred within WorkOS or within third-party identity and directory providers. They are used to keep your app in sync with WorkOS data. For more details on consuming events in your app, check out the data syncing guide.
Refer to the Events page for a full list of events that WorkOS emits.
Get a list of all of events up to 30 days old.
curl --request GET --url "https://api.workos.com/events?events=dsync.user.created,dsync.user.updated,dsync.user.deleted" \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "list", "data": [ { "object": "event", "id": "event_01H2GNQD5D7ZE06FDDS75NFPHY", "event": "dsync.group.user_added", "data": { "user": { "id": "directory_user_01E1X56GH84T3FB41SD6PZGDBX", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "idp_id": "2936", "first_name": "Eric", "last_name": "Schneider", "email": "eric@example.com", "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "custom_attributes": { "department": "Engineering", "job_title": "Software Engineer" }, "role": { "slug": "member" }, "raw_attributes": {} }, "group": { "id": "directory_group_01E1X5GPMMXF4T1DCERMVEEPVW", "idp_id": "02grqrue4294w24", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "name": "Developers", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "raw_attributes": {} } }, "created_at": "2023-06-09T18:12:01.837Z" } ], "list_metadata": { "after": "event_01H2GQNMQNH8VRXVR7AEYG9XCJ" } }
GET/eventsParameters Returns objectAn Organization is a top-level resource in WorkOS. Each Connection, Directory, and Audit Trail Event belongs to an Organization. An Organization will usually represent one of your customers. There is no limit to the number of organizations you can create in WorkOS.
{ "object": "organization", "id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "name": "Foo Corp", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "object": "organization_domain", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "organization_id": "org_01HE8GSH8FQPASKSY27THRKRBP", "domain": "foo-corp.com", "state": "verified", "verification_strategy": "dns", "verification_token": "m5Oztg3jdK4NJLgs8uIlIprMw" } ], "stripe_customer_id": "cus_R9qWAGMQ6nGE7V", "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "tier": "diamond" } }
organizationGet the details of an existing organization.
curl https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "object": "organization", "name": "Foo Corporation", "allow_profiles_outside_organization": false, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "domain": "foo-corp.com", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "organization_domain" }, { "domain": "another-foo-corp-domain.com", "id": "org_domain_01EHZNS0H9W90A90FV79GAB6AB", "object": "organization_domain" } ] }
Get the details of an existing organization by an external identifier.
curl https://api.workos.com/organizations/external_id/2fe01467-f7ea-4dd2-8b79-c2b4f56d0191 \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "object": "organization", "name": "Foo Corporation", "allow_profiles_outside_organization": false, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "domain": "foo-corp.com", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "organization_domain" }, { "domain": "another-foo-corp-domain.com", "id": "org_domain_01EHZNS0H9W90A90FV79GAB6AB", "object": "organization_domain" } ] }
Get a list of all of your existing organizations matching the criteria specified.
curl https://api.workos.com/organizations?domains=foo-corp.com \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "object": "organization", "name": "Foo Corp", "allow_profiles_outside_organization": false, "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "tier": "diamond" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "domain": "foo-corp.com", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "organization_domain" }, { "domain": "another-foo-corp-domain.com", "id": "org_domain_01EHZNS0H9W90A90FV79GAB6AB", "object": "organization_domain" } ] } ], "list_metadata": { "before": "org_01EHZNVPK3SFK441A1RGBFSHRT", "after": "org_01EJBGJT2PC6638TN5Y380M40Z" } }
GET/organizationsParameters Returns objectCreates a new organization in the current environment.
You can include one or more domains to associate with the organization, but you should verify the ownership of every domain before setting its state to verified.
curl --request POST \ --url https://api.workos.com/organizations \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "name": "Foo Corp", "domain_data": [ { "domain": "foo-corp.com", "state": "pending" } ], "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "tier": "diamond" } } BODY
{ "id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "object": "organization", "name": "Foo Corp", "allow_profiles_outside_organization": false, "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "tier": "diamond" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "domain": "foo-corp.com", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "organization_domain" }, { "domain": "another-foo-corp-domain.com", "id": "org_domain_01EHZNS0H9W90A90FV79GAB6AB", "object": "organization_domain" } ] }
Updates an organization in the current environment.
You can include one or more domains to associate with the organization, but you should verify the ownership of every domain before setting its state to verified.
curl --request PUT \ --url https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "name": "Foo Corp", "domain_data": [ { "domain": "foo-corp.com", "state": "verified" } ], "stripe_customer_id": "cus_R9qWAGMQ6nGE7V", "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "tier": "diamond" } } BODY
{ "id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "object": "organization", "name": "Foo Corp", "allow_profiles_outside_organization": false, "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "tier": "diamond" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "domain": "foo-corp.com", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "organization_domain" }, { "domain": "another-foo-corp-domain.com", "id": "org_domain_01EHZNS0H9W90A90FV79GAB6AB", "object": "organization_domain" } ] }
Permanently deletes an organization in the current environment. It cannot be undone.
curl --request DELETE \ --url https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT \ --header "Authorization: Bearer sk_example_123456789"
DELETE/organizationsParameters An Organization Domain (also known as a User Email Domain) represents an Organization’s domain.
These domains restrict which email addresses are able to sign in through SAML Connections when allow profiles outside organization is false. This is the default behavior for Organizations. See SSO frequently asked questions for more details on this behavior.
Organization domains can be verified manually (through the API or the Dashboard), or through a self-serve flow through the Admin Portal.
The organization that defines this domain policy exerts authentication policy control over that domain across your application.
For this reason, it is important to verify ownership of manually added domains.
Additionally, WorkOS does not allow addition of common consumer domains, like gmail.com.
{ "object": "organization_domain", "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "organization_id": "org_01HE8GSH8FQPASKSY27THRKRBP", "domain": "foo-corp.com", "state": "verified", "verification_strategy": "dns", "verification_token": "m5Oztg3jdK4NJLgs8uIlIprMw" }
organization_domainA role is an access control resource that can be assigned to organization memberships, directory users, and SSO profiles.
{ "object": "role", "id": "role_01EHZNVPK3SFK441A1RGBFSHRT", "name": "Member", "slug": "member", "description": "Access to basic resources", "permissions": ["posts:read", "posts:write"], "type": "EnvironmentRole", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
RoleGet a list of all roles for the provided organization in priority order. Includes all environment and organization roles.
curl https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/roles \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "id": "role_01EHZNVPK3SFK441A1RGBFSRTY", "object": "role", "name": "Admin", "slug": "admin", "description": "Access to all resources", "permissions": ["posts:read", "posts:write"], "type": "EnvironmentRole", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, { "id": "role_01EHZNVPK3SFK441A1RGBFSHRT", "object": "role", "name": "Member", "slug": "member", "description": "Access to basic resources", "permissions": [], "type": "EnvironmentRole", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, { "id": "role_01EHZNVPK3SFK441A1RGBFSYUP", "object": "role", "name": "Billing Manager", "slug": "billing-manager", "description": "Access to billing resources", "permissions": ["billing:manage"], "type": "OrganizationRole", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ] }
GET/organizationsReturns objectAuthKit is a user management platform that provides a set of user authentication and organization security features designed to provide a fast, scalable integration while handling all of the user management complexity that comes with advanced B2B customer needs.
To automatically respond to AuthKit activities, like authentication and changes related to the users, use the corresponding events.
Represents a user identity in your application. A user can sign up in your application directly with a method like password, or they can be JIT-provisioned through an organization’s SSO connection.
Users may belong to organizations as members.
See the events reference documentation for the user events.
{ "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "last_sign_in_at": "2021-06-25T19:07:33.155Z", "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222", "metadata": { "language": "en" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
userGet the details of an existing user.
curl https://api.workos.com/user_management/users/user_01E4ZCR3C56J083X43JQXF3JK5 \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "last_sign_in_at": "2021-06-25T19:07:33.155Z", "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222", "metadata": { "language": "en" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get the details of an existing user by an external identifier.
curl https://api.workos.com/user_management/users/external_id/f1ffa2b2-c20b-4d39-be5c-212726e11222 \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "last_sign_in_at": "2021-06-25T19:07:33.155Z", "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222", "metadata": { "language": "en" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get a list of all of your existing users matching the criteria specified.
curl https://api.workos.com/user_management/users \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "last_sign_in_at": "2021-06-25T19:07:33.155Z", "external_id": "f1ffa2b2-c20b-4d39-be5c-212726e11222", "metadata": { "language": "en" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ], "list_metadata": { "before": "user_01E4ZCR3C56J083X43JQXF3JK5", "after": "user_01EJBGJT2PC6638TN5Y380M40Z" } }
GET/user_managementParameters Returns objectCreate a new user in the current environment.
curl --request POST \ --url https://api.workos.com/user_management/users \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "email": "marcelina@example.com", "password": "i8uv6g34kd490s", "first_name": "Marcelina", "last_name": "Davis", "email_verified": false } BODY
{ "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "last_sign_in_at": "2021-06-25T19:07:33.155Z", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Updates properties of a user. The omitted properties will be left unchanged.
curl --request PUT \ --url https://api.workos.com/user_management/users/user_01EHQ7ZGZ2CZVQJGZ5ZJZ1ZJGZ \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "language": "en" } } BODY
{ "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "external_id": "2fe01467-f7ea-4dd2-8b79-c2b4f56d0191", "metadata": { "language": "en" }, "last_sign_in_at": "2021-06-25T19:07:33.155Z", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Permanently deletes a user in the current environment. It cannot be undone.
curl --request DELETE \ --url https://api.workos.com/user_management/users/user_01F3GZ5ZGZBZVQGZVHJFVXZJGZ \ --header "Authorization: Bearer sk_example_123456789"
DELETE/user_managementParameters Represents User identities obtained from external identity providers.
When a user authenticates using an external provider like Google OAuth, information from that provider will be made available as one of the user’s Identities. You can read more about the process in our identity linking guide.
Applications should check the type before making assumptions about the shape of the identity. Currently only OAuth identities are supported, but more types may be added in the future.
{ "idp_id": "4F42ABDE-1E44-4B66-824A-5F733C037A6D", "type": "OAuth", "provider": "MicrosoftOAuth" }
identityGet a list of identities associated with the user. A user can have multiple associated identities after going through identity linking. Currently only OAuth identities are supported. More provider types may be added in the future.
curl https://api.workos.com/user_management/users/user_01E4ZCR3C56J083X43JQXF3JK5/identities \ --header "Authorization: Bearer sk_example_123456789"
[ { "idp_id": "4F42ABDE-1E44-4B66-824A-5F733C037A6D", "type": "OAuth", "provider": "MicrosoftOAuth" } ]
GET/user_managementParameters Returns Generates an OAuth 2.0 authorization URL to authenticate a user with AuthKit or SSO.
curl https://api.workos.com/user_management/authorize -G \ -d response_type=code \ -d client_id=client_123456789 \ -d redirect_uri=https://your-app.com/callback \ -d state=dj1kUXc0dzlXZ1hjUQ== \ -d connection_id=conn_01E4ZCR3C56J083X43JQXF3JK5
https://api.workos.com/user_management/authorize? response_type=code& client_id=client_123456789& redirect_uri=https://your-app.com/callback& state=dj1kUXc0dzlXZ1hjUQ==& connection_id=conn_01E4ZCR3C56J083X43JQXF3JK5
GET/user_managementReturns If you are using AuthKit, set the provider parameter to "authkit", which will generate an authorization URL for your AuthKit domain. AuthKit will take care of detecting the user’s authentication method, such as identifying whether they use Email + Password or Single Sign-On,and direct them to the corresponding login flow.
Otherwise, to generate an authorization URL for a WorkOS SSO connection, you’ll have to specify the user’s connection, organization, or OAuth provider as a parameter. These connection selectors are mutually exclusive, and exactly one must be provided. The generated URL automatically directs the user to their identity provider. Once the user authenticates with their identity provider, WorkOS then issues a redirect to your redirect URI to complete the sign-in flow.
In the OAuth 2.0 protocol, a redirect URI is the location that the user is redirected to once they have successfully authenticated with their identity provider.
When redirecting the user, WorkOS will generate an authorization code and pass it to your redirect URI as a code query parameter, your app will use this code to authenticate the user. Additionally, WorkOS can pass a state parameter back to your application that you may use to encode arbitrary information to restore your application state between the redirects.
https://your-app.com/callback?code=01E2RJ4C05B52KKZ8FSRDAP23J&state=dj1kUXc0dzlXZ1hjUQ==
You can use state to encode parameters like originating URL and query parameters. This is useful in a flow where unauthenticated users are automatically redirected to a login page. After successful sign in, users will be routed to your redirect URI callback route. From there you can extract the originating URL from state and redirect the user to their intended destination.
You’ll need to configure the allowed redirect URIs for your application via the Redirects page in the dashboard. Without a valid redirect URI, your users will be unable to sign in. Make sure that the redirect URI you use as a parameter to get the authorization URL matches one of the redirect URIs you have configured in the dashboard.
Redirect URIs follow stricter requirements in production environments:
HTTPS protocol is required in production environmentsHTTP and localhost are allowed in staging environmentshttp://127.0.0.1 in production environments to support native clients.WorkOS supports using wildcard characters in Redirect URIs. The * symbol can be used as a wildcard for subdomains; however, it must be used in accordance with the following rules in order to properly function.
http://*.com will not work.https://sub.*.example.com will not work.https://*.*.example.com will not work.https://prefix-*-suffix.example.com will work.https://*.example.com will not work with https://sub1.sub2.example.com.https://*.ngrok-free.app will not work.A through Z, and a through z ); digits (0 through 9), hyphens (-), and underscores (_). For example, https://user:secret@foo.example.com will not work with https://*.example.com.The Proof Key for Code Exchange (PKCE) flow is an extension to the OAuth 2.0 Authorization Code flow. It enables public clients, like native apps or single-page apps, to perform the authorization code flow securely. If you are developing a client that makes API calls in public, you’ll need to use this flow.
In this flow, your client generates a code verifier which is a high-entropy cryptographic random string. A code challenge is derived by hashing the code verifier. Instead of using a client secret, provide the code challenge when getting the authorization URL and the code verifier when authenticating a User.
If there is an issue generating an authorization URL, the API will return the original redirect URI with error and error_description query parameters. If provided, the state value will also be included.
https://your-app.com/callback?error=organization_invalid&error_description=No%20connection%20associated%20with%20organization&state=123456789
Possible error codes and the corresponding descriptions are listed below.
| Error code | Description |
|---|---|
access_denied | The user denied an OAuth authorization request at the identity provider. |
ambiguous_connection_selector | A connection could not be uniquely identified using the provided connection selector (e.g., organization). This can occur when there are multiple SSO connections under the same organization. If you need multiple SSO connections for an organization, use the connection parameter to identify which connection to use for SSO. |
connection_invalid | There is no connection for the provided ID. |
connection_strategy_invalid | The provider has multiple strategies associated per environment. |
connection_unlinked | The connection associated with the request is unlinked. |
invalid_connection_selector | A valid connection selector query parameter must be provided in order to correctly determine the proper connection to return an authorization URL for. Valid connection selectors are either connection, organization, or provider. |
organization_invalid | There is no organization matching the provided ID. |
oauth_failed | An OAuth authorization request failed for a user. |
server_error | The SSO authentication failed for the user. More detailed errors and steps to resolve are available in the Sessions tab on the connection page in the WorkOS Dashboard. |
Authenticates a user using AuthKit, OAuth or an organization’s SSO connection.
AuthKit handles all authentication methods, however it is conceptually similar to a social login experience. Like OAuth and SSO, AuthKit returns you a code that you can exchange for an authenticated user. See Integrating with AuthKit.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_example_123456789", "grant_type": "authorization_code", "code": "01E2RJ4C05B52KKZ8FSRDAP23J", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" } BODY
{ "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG", "access_token": "eyJhb.nNzb19vaWRjX2tleV9.lc5Uk4yWVk5In0", "refresh_token": "yAjhKk123NLIjdrBdGZPf8pLIDvK", "impersonator": { "email": "admin@foocorp.com", "reason": "Investigating an issue with the customer's account." } }
POST/user_managementParameters Returns objectAuthenticates a user with email and password.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_example_123456789", "grant_type": "password", "email": "marcelina@example.com", "password": "i8uv6g34kd490s", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" } BODY
{ "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG", "access_token": "eyJhb.nNzb19vaWRjX2tleV9.lc5Uk4yWVk5In0", "refresh_token": "yAjhKk123NLIjdrBdGZPf8pLIDvK" }
POST/user_managementParameters Returns objectAuthenticates a user by verifying the Magic Auth code sent to the user’s email.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_example_123456789", "grant_type": "urn:workos:oauth:grant-type:magic-auth:code", "code": "123456", "email": "marcelina.davis@example.com", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" } BODY
{ "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG" }
POST/user_managementParameters Returns objectUse this endpoint to exchange a refresh token for a new access token. Refresh tokens are single use, so a new refresh token is returned.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_test_123", "grant_type": "refresh_token", "refresh_token": "Xw0NsCVXMBf7svAoIoKBmkpEK", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (X11; Linux x86_64; rv:123.0) Gecko/20100101 Firefox/123.0" } BODY
{ "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6", "refresh_token": "gTsE0Rb9MJq7eL0dUmcGvoCwL" }
POST/user_managementParameters Returns objectAuthenticates a user with an unverified email and verifies their email address.
A user with an unverified email address won’t be able to authenticate right away. When they attempt to authenticate with their credentials, the API will return an email verification required error that contains a pending authentication token.
If the email setting for email verification is enabled, WorkOS will automatically send a one-time email verification code to the user’s email address. If the email setting is not enabled, retrieve the email verification code to send the email yourself. Use the pending authentication token from the error and the one-time code the user received to authenticate them and to complete the email verification process.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_example_123456789", "grant_type": "urn:workos:oauth:grant-type:email-verification:code", "code": "123456", "pending_authentication_token": "ql1AJgNoLN1tb9llaQ8jyC2dn", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" } BODY
{ "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG" }
POST/user_managementParameters Returns objectAuthenticates a user enrolled into MFA using time-based one-time password (TOTP).
Users enrolled into MFA are required to enter a TOTP each time they sign in. When they attempt to authenticate with their credentials, the API will return an MFA challenge error that contains a pending authentication token.
To continue with the authentication flow, challenge one of the factors returned by the MFA challenge error response and present a UI to the user to enter the TOTP code. Then, authenticate the user with the TOTP code, the challenge from the factor, and the pending authentication token from the MFA challenge error.
MFA can be enabled via the Authentication page in the WorkOS dashboard.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_example_123456789", "grant_type": "urn:workos:oauth:grant-type:mfa-totp", "code": "123456", "pending_authentication_token": "ql1AJgNoLN1tb9llaQ8jyC2dn", "authenticationChallengeId": "auth_challenge_01FVYZWQTZQ5VB6BC5MPG2EYC5", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" } BODY
{ "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG" }
POST/user_managementParameters Returns objectAuthenticates a user into an organization they are a member of.
When a user who is a member of multiple organizations attempts to authenticate with their credentials, the API will return an organization selection error that contains a pending authentication token. To continue with the authentication flow, your application should display the list of organizations for the user to choose.
Use the pending authentication token from the error and the organization the user selected in your UI to complete the authentication.
curl --request POST \ --url https://api.workos.com/user_management/authenticate \ --header "Content-Type: application/json" \ -d @- <<BODY { "client_id": "client_123456789", "client_secret": "sk_example_123456789", "grant_type": "urn:workos:oauth:grant-type:organization-selection", "pending_authentication_token": "ql1AJgNoLN1tb9llaQ8jyC2dn", "organization_id": "org_01H93Z2SYX1D3NJ536M94T8SHP", "ip_address": "192.0.2.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36" } BODY
{ "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }, "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG" }
POST/user_managementParameters Returns objectAuthenticates a user using an AuthKit session cookie. This method does not make a network call, but simply unseals an existing session cookie and decodes the JWT claims from the access token.
import { AuthenticateWithSessionCookieFailureReason, WorkOS, } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789', { // clientId is required to be passed in to use the authenticateWithSessionCookie method clientId: 'client_123456789', }); const { authenticated, ...restOfAuthenticationResponse } = await workos.userManagement.authenticateWithSessionCookie({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', }); if (authenticated) { // User is authenticated and session data can be utilized const { sessionId, organizationId, role, permissions } = restOfAuthenticationResponse; } else { const { reason } = restOfAuthenticationResponse; // Can use AuthenticateWithSessionCookieFailureReason to handle failure reasons if ( reason === AuthenticateWithSessionCookieFailureReason.NO_SESSION_COOKIE_PROVIDED ) { // Redirect the user to the login page } }
{ "authenticated": true, "session_id": "session_01HQSXZGF8FHF7A9ZZFCW4387R", "organization_id": "org_01H945H0YD4F97JN9MATX7BYAG", "role": "member", "permissions": ["posts:read", "posts:write"] }
{ "authenticated": false, "reason": "invalid_session_cookie" }
userManagementParameters objectReturns objectUnseals the provided session data from a user’s session cookie, authenticates with the existing refresh token, and returns the sealed data for the refreshed session.
import { RefreshAndSealSessionDataFailureReason, WorkOS, } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789', { // clientId is required to be passed in to use the refreshAndSealSessionData method clientId: 'client_123456789', }); const { authenticated, ...restOfRefreshResponse } = await workos.userManagement.refreshAndSealSessionData({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', }); if (authenticated) { const { sealedSession } = restOfRefreshResponse; // Set the sealed session in a cookie } else { const { reason } = restOfRefreshResponse; // Can use RefreshAndSealSessionDataFailureReason to handle failure reasons if ( reason === RefreshAndSealSessionDataFailureReason.NO_SESSION_COOKIE_PROVIDED ) { // Redirect the user to the login page } }
{ "authenticated": true, "sealed_session": "Fe26.2*1*d7f59d8b9d29c26c44dd3df2b56a7d1d40d4" }
{ "authenticated": false, "reason": "invalid_session_cookie" }
userManagementParameters objectReturns objectThis hosts the public key that is used for verifying access tokens.
curl https://api.workos.com/sso/jwks/client_123456789
https://api.workos.com/sso/jwks/client_123456789
GET/ssoReturns The access token that is returned in successful authentication responses is a JWT that can be used to verify that a user has an active session. The JWT is signed by a JWKS which can be retrieved from the WorkOS API.
{ "iss": "https://api.workos.com", "sub": "user_01HBEQKA6K4QJAS93VPE39W1JT", "act": { "sub": "admin@foocorp.com" }, "org_id": "org_01HRDMC6CM357W30QMHMQ96Q0S", "role": "member", "permissions": ["posts:read", "posts:write"], "entitlements": ["audit-logs"], "sid": "session_01HQSXZGF8FHF7A9ZZFCW4387R", "jti": "01HQSXZXPPFPKMDD32RKTFY6PV", "exp": 1709193857, "iat": 1709193557 }
Access Token JWTThe refresh token can be used to obtain a new access token using the authenticate with refresh token endpoint. Refresh tokens may only be used once. Refreshes will succeed as long as the user’s session is still active.
After authenticating and storing the encrypted session as a cookie, retrieving and decrypting the session is made easy via the session helper methods.
Load the session by providing the sealed session and the cookie password.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789', { clientId: 'client_123456789', }); const session = await workos.userManagement.loadSealedSession({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', });
userManagementParameters objectReturns objectUnseals the session data and checks if the session is still valid.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789', { clientId: 'client_123456789', }); const session = await workos.userManagement.loadSealedSession({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', }); const authResponse = await session.authenticate(); if (authResponse.authenticated) { // User is authenticated and session data can be used const { sessionId, organizationId, role, permissions, user } = authResponse; } else { if (authResponse.reason === 'no_session_cookie_provided') { // Redirect the user to the login page } }
sessionReturns objectRefreshes the user’s session with the refresh token. Passing in a new organization ID will switch the user to that organization.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789', { clientId: 'client_123456789', }); const session = await workos.userManagement.loadSealedSession({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', }); const refreshResult = await session.refresh(); if (!refreshResult.authenticated) { // Redirect the user to the login page } const { session: userSession, sealedSession, user, organizationId, role, permissions, entitlements, impersonator, } = refreshResult; // Use claims and userSession for further business logic // Set the sealedSession in a cookie
sessionParameters objectReturns RefreshSessionResponseEnd a user’s session. The user’s browser should be redirected to this URL. Functionally similar to Get logout URL but extracts the session ID automatically from the session data.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789', { clientId: 'client_123456789', }); const session = await workos.userManagement.loadSealedSession({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', }); const logOutUrl = await session.getLogOutUrl(); // Redirect the user to the log out URL
sessionReturns Integrating the authentication API directly requires handling error responses for email verification, MFA challenges, identity linking, and organization selection. One or more of these responses may be returned for an authentication attempt with any authentication method.
Hosted AuthKit handles authentication errors for you and may be a good choice if you prefer a simpler integration.
This error indicates that a user with an unverified email address attempted to authenticate in an environment where email verification is required. It includes a pending authentication token that should be used to complete the authentication.
{ "code": "email_verification_required", "message": "Email ownership must be verified before authentication.", "pending_authentication_token": "YQyCkYfuVw2mI3tzSrk2C1Y7S", "email": "marcelina.davis@example.com", "email_verification_id": "email_verification_01HYGGEB6FYMWQNWF3XDZG7VV3" }
email_verification_requiredWhen this error occurs and the email setting for email verification is enabled, WorkOS will automatically send a one-time email verification code to the user’s email address and issue a pending authentication token. If the email setting is not enabled, retrieve the email verification code to send the email verification email yourself. To complete the authentication process, use the pending authentication token from the error and the one-time code the user received to authenticate them and to verify their email address.
The same applies when a user attempts to authenticate with OAuth or SSO, but there was already an account with a matching unverified email address.
This error indicates that a user who is not enrolled into MFA attempted to authenticate in an environment where MFA is required. It includes a pending authentication token that should be used to authenticate the user once they enroll into MFA.
{ "code": "mfa_enrollment", "message": "The user must enroll in MFA to finish authenticating.", "pending_authentication_token": "YQyCkYfuVw2mI3tzSrk2C1Y7S", "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19: 07: 33.155Z", "updated_at": "2021-06-25T19: 07: 33.155Z" } }
mfa_enrollmentWhen this error occurs, you’ll need to present an MFA enrollment UI to the user. Once the user has enrolled, present an MFA challenge UI to the user and authenticate them with their TOTP code and the pending authentication token from this error.
MFA can be enabled via the Authentication page in the WorkOS dashboard.
This error indicates that a user enrolled into MFA attempted to authenticate in an environment where MFA is required. It includes a pending authentication token and a list of factors that the user is enrolled in that should be used to complete the authentication.
{ "code": "mfa_challenge", "message": "The user must complete an MFA challenge to finish authenticating.", "pending_authentication_token": "YQyCkYfuVw2mI3tzSrk2C1Y7S", "authentication_factors": [ { "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ", "type": "totp" } ], "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } }
mfa_challengeWhen this error occurs, you’ll need to present an MFA challenge UI to the user and authenticate them with their TOTP code, the pending authentication token from this error, and a challenge that corresponds to one of the authentication factors.
MFA can be enabled via the Authentication page in the WorkOS dashboard.
This error indicates that the user is a member of multiple organizations and must select which organization to sign in to. It includes a list of organizations the user is a member of and a pending authentication token that should be used to complete the authentication.
{ "code": "organization_selection_required", "message": "The user must choose an organization to finish their authentication.", "pending_authentication_token": "YQyCkYfuVw2mI3tzSrk2C1Y7S", "organizations": [ { "id": "org_01H93RZAP85YGYZJXYPAZ9QTXF", "name": "Foo Corp" }, { "id": "org_01H93S4E6GB5A8PFNKGTA4S42X", "name": "Bar Corp" } ], "user": { "object": "user", "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "first_name": "Marcelina", "last_name": "Davis", "email_verified": true, "profile_picture_url": "https://workoscdn.com/images/v1/123abc", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } }
organization_selection_requiredWhen this error occurs, you’ll need to display the list of organizations that the user is a member of and authenticate them with the selected organization using the pending authentication token from the error.
This error indicates that a user attempted to authenticate into an organization that requires SSO using a different authentication method. It includes a list of SSO connections that may be used to complete the authentication.
{ "error": "sso_required", "error_description": "User must authenticate using one of the matching connections.", "connection_ids": ["conn_01DRF1T7JN6GXS8KHS0WYWX1YD"] }
sso_requiredWhen this error occurs, you’ll need to use one of the SSO connections from the error to get the authorization URL and redirect the user to that URL to complete the authentication with the organization’s identity provider.
This error indicates that a user attempted to authenticate with an authentication method that is not allowed by the organization that has a domain policy managing this user. It includes all the possible methods the user can use to authenticate.
{ "error": "organization_authentication_methods_required", "error_description": "User must authenticate using one of the methods allowed by the organization.", "sso_connection_ids": ["conn_01DRF1T7JN6GXS8KHS0WYWX1YD"], "auth_methods": { "apple_oauth": false, "github_oauth": false, "google_oauth": true, "magic_auth": false, "microsoft_oauth": false, "password": false } }
organization_authentication_methods_requiredWhen this error occurs, you’ll need to present the user with these options so they can choose which method to continue authentication.
Magic Auth is a passwordless authentication method that allows users to sign in or sign up via a unique, six digit one-time-use code sent to their email inbox. To verify the code, authenticate the user with Magic Auth.
{ "id": "magic_auth_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "expires_at": "2021-07-01T19:07:33.155Z", "code": "123456", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get the details of an existing Magic Auth code that can be used to send an email to a user for authentication.
curl https://api.workos.com/user_management/magic_auth/magic_auth_01E4ZCR3C56J083X43JQXF3JK5 \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "magic_auth_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "expires_at": "2021-07-01T19:07:33.155Z", "code": "123456", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Creates a one-time authentication code that can be sent to the user’s email address. The code expires in 10 minutes. To verify the code, authenticate the user with Magic Auth.
curl --request POST \ --url https://api.workos.com/user_management/magic_auth \ --header "Authorization: Bearer sk_example_123456789" \ -d email="marcelina.davis@example.com"
{ "id": "magic_auth_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "expires_at": "2021-07-01T19:07:33.155Z", "code": "123456", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Enroll users in multi-factor authentication for an additional layer of security. MFA can be enabled via the Authentication page in the WorkOS dashboard.
Represents an authentication factor.
{ "object": "authentication_factor", "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ", "created_at": "2022-02-15T15:14:19.392Z", "updated_at": "2022-02-15T15:14:19.392Z", "type": "totp", "totp": { "issuer": "Foo Corp", "user": "alan.turing@example.com", "qr_code": "data:image/png;base64,{base64EncodedPng}", "secret": "NAGCCFS3EYRB422HNAKAKY3XDUORMSRF", "uri": "otpauth://totp/FooCorp:alan.turing@example.com?secret=NAGCCFS3EYRB422HNAKAKY3XDUORMSRF&issuer=FooCorp" }, "userId": "user_01FVYZ5QM8N98T9ME5BCB2BBMJ" }
authentication_factorRepresents a challenge of an authentication factor.
{ "object": "authentication_challenge", "id": "auth_challenge_01FVYZWQTZQ5VB6BC5MPG2EYC5", "created_at": "2022-02-15T15:26:53.274Z", "updated_at": "2022-02-15T15:26:53.274Z", "expires_at": "2022-02-15T15:36:53.279Z", "authentication_factor_id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ" }
authentication_challengeEnrolls a user in a new authentication factor.
curl --request POST \ --url https://api.workos.com/user_management/users/user_01E4ZCR3C56J083X43JQXF3JK5/auth_factors \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "type": "totp", "totp_issuer": "Foo Corp", "totp_user": "bob@example.com" } BODY
POST/user_managementParameters Returns objectLists the authentication factors for a user.
curl https://api.workos.com/user_management/users/user_01E4ZCR3C56J083X43JQXF3JK5/auth_factors \ --header "Authorization: Bearer sk_example_123456789"
GET/user_managementParameters Returns objectEmail verification is a security feature that requires users to verify their email address before they can sign in to your application. It is enabled by default.
Users signing in with Magic Auth, Google OAuth, Apple OAuth, or SSO are automatically verified. For other authentication methods, an email verification flow is required to confirm that the user’s email address belongs to them.
{ "id": "email_verification_01HYGGEB6FYMWQNWF3XDZG7VV3", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "expires_at": "2021-07-01T19:07:33.155Z", "code": "123456", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get the details of an existing email verification code that can be used to send an email to a user for verification.
curl https://api.workos.com/user_management/email_verification/email_verification_01HYGGEB6FYMWQNWF3XDZG7VV3 \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "email_verification_01HYGGEB6FYMWQNWF3XDZG7VV3", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "expires_at": "2021-07-01T19:07:33.155Z", "code": "123456", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Create a password reset token for a user and reset the user’s password.
When a user’s password is reset, all of their active sessions are revoked.
{ "id": "password_reset_01HYGDNK5G7FZ4YJFXYXPB5JRW", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "password_reset_token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "password_reset_url": "https://your-app.com/reset-password?token=Z1uX3RbwcIl5fIGJJJCXXisdI", "expires_at": "2021-07-01T19:07:33.155Z", "created_at": "2021-06-25T19:07:33.155Z" }
Get the details of an existing password reset token that can be used to reset a user’s password.
curl https://api.workos.com/user_management/password_reset/password_reset_01HYGDNK5G7FZ4YJFXYXPB5JRW \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "password_reset_01HYGDNK5G7FZ4YJFXYXPB5JRW", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "password_reset_token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "password_reset_url": "https://your-app.com/reset-password?token=Z1uX3RbwcIl5fIGJJJCXXisdI", "expires_at": "2021-07-01T19:07:33.155Z", "created_at": "2021-06-25T19:07:33.155Z" }
Creates a one-time token that can be used to reset a user’s password.
curl --request POST \ --url https://api.workos.com/user_management/password_reset \ --header "Authorization: Bearer sk_example_123456789" \ -d email="marcelina.davis@example.com"
{ "id": "password_reset_01HYGDNK5G7FZ4YJFXYXPB5JRW", "user_id": "user_01HWWYEH2NPT48X82ZT23K5AX4", "email": "marcelina.davis@example.com", "password_reset_token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "password_reset_url": "https://your-app.com/reset-password?token=Z1uX3RbwcIl5fIGJJJCXXisdI", "expires_at": "2021-07-01T19:07:33.155Z", "created_at": "2021-06-25T19:07:33.155Z" }
Sets a new password using the token query parameter from the link that the user received. Successfully resetting the password will verify a user’s email, if it hasn’t been verified yet.
curl --request POST \ --url https://api.workos.com/user_management/password_reset/confirm \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "token": "stpIJ48IFJt0HhSIqjf8eppe0", "new_password": "i8uv6g34kd490s" } BODY
POST/user_managementParameters Returns objectAn organization membership is a top-level resource that represents a user’s relationship with an organization. A user may be a member of zero, one, or many organizations.
See the events reference documentation for the organization membership events.
{ "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "role": { "slug": "admin" }, "status": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
organization_membershipGet the details of an existing organization membership.
curl https://api.workos.com/user_management/organization_memberships/om_01E4ZCR3C56J083X43JQXF3JK5 \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "role": { "slug": "member" }, "status": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get a list of all organization memberships matching the criteria specified. At least one of user_id or organization_id must be provided. By default only active memberships are returned. Use the statuses parameter to filter by other statuses.
curl https://api.workos.com/user_management/organization_memberships \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "organization_name": "Acme, Inc.", "role": { "slug": "member" }, "status": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ], "list_metadata": { "before": "om_01E4ZCR3C56J083X43JQXF3JK5", "after": "om_01EJBGJT2PC6638TN5Y380M40Z" } }
GET/user_managementParameters Returns objectCreates a new active organization membership for the given organization and user.
Calling this API with an organization and user that match an inactive organization membership will activate the membership with the specified role.
curl --request POST \ --url https://api.workos.com/user_management/organization_memberships \ --header "Authorization: Bearer sk_example_123456789" \ -d user_id="user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E" \ -d organization_id="org_01E4ZCR3C56J083X43JQXF3JK5" \ -d role_slug="admin"
{ "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "role": { "slug": "admin" }, "status": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Update the details of an existing organization membership.
curl --request PUT \ --url https://api.workos.com/user_management/organization_memberships/om_01E4ZCR3C56J083X43JQXF3JK5 \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "role_slug": "admin" } BODY
{ "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "role": { "slug": "admin" }, "status": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-27T19:07:33.278Z" }
Permanently deletes an existing organization membership. It cannot be undone.
curl --request DELETE \ --url https://api.workos.com/user_management/organization_memberships/om_01E4ZCR3C56J083X43JQXF3JK5 \ --header "Authorization: Bearer sk_example_123456789"
DELETE/user_managementParameters Deactivates an active organization membership. Emits an organization_membership.updated event upon successful deactivation.
inactive membership is a no-op and does not emit an event.pending membership returns an error. This membership should be deleted instead.See the membership management documentation for additional details.
curl --request PUT \ --url https://api.workos.com/user_management/organization_memberships/om_01E4ZCR3C56J083X43JQXF3JK5/deactivate \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "role": { "slug": "member" }, "status": "inactive", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
PUT/user_managementParameters Returns Reactivates an inactive organization membership, retaining the pre-existing role. Emits an organization_membership.updated event upon successful reactivation.
active membership is a no-op and does not emit an event.pending membership returns an error. The user needs to accept the invitation instead.See the membership management documentation for additional details.
curl --request PUT \ --url https://api.workos.com/user_management/organization_memberships/om_01E4ZCR3C56J083X43JQXF3JK5/reactivate \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "organization_membership", "id": "om_01E4ZCR3C56J083X43JQXF3JK5", "user_id": "user_01E4ZCR3C5A4QZ2Z2JQXGKZJ9E", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "role": { "slug": "member" }, "status": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
PUT/user_managementParameters Returns An email invitation allows the recipient to sign up for your app and join a specific organization. When an invitation is accepted, a user and a corresponding organization membership are created.
Users may be invited to your app without joining an organization, or they may be invited to join an organization if they already have an account. Invitations may be also issued on behalf of another user. In this case, the invitation email will mention the name of the user who invited the recipient.
{ "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "pending", "accepted_at": null, "revoked_at": null, "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get the details of an existing invitation.
curl https://api.workos.com/user_management/invitations/invitation_123456789 \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "invitation", "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "pending", "accepted_at": null, "revoked_at": null, "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Retrieve an existing invitation using the token.
curl https://api.workos.com/user_management/invitations/by_token/Z1uX3RbwcIl5fIGJJJCXXisdI \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "invitation", "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "pending", "accepted_at": null, "revoked_at": null, "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get a list of all of invitations matching the criteria specified.
curl https://api.workos.com/user_management/invitations \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "object": "invitation", "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "pending", "accepted_at": null, "revoked_at": null, "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ], "list_metadata": { "before": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "after": "invitation_01EJBGJT2PC6638TN5Y380M40Z" } }
GET/user_managementParameters Returns objectSends an invitation email to the recipient.
curl --request POST \ --url https://api.workos.com/user_management/invitations \ --header "Authorization: Bearer sk_example_123456789" \ -d email="marcelina.davis@example.com"
{ "object": "invitation", "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "pending", "accepted_at": null, "revoked_at": null, "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Accepts an invitation and, if linked to an organization, activates the user’s membership in that organization.
In most cases, use existing authentication methods like authenticateWithCode, which also accept an invitation token. These methods offer the same functionality (invitation acceptance and membership activation) while also signing the user in.
This method is useful for apps requiring a highly customized invitation flow, as it focuses solely on handling invitations without authentication. It’s also helpful when users can be invited to multiple organizations and need a way to accept invitations after signing in.
Your application should verify that the invitation is intended for the user accepting it. For example, by fetching the invitation using the find-by-token endpoint and ensuring the email matches the email address of the accepting user.
curl --request POST \ --url https://api.workos.com/user_management/invitations/invitation_01E4ZCR3C56J083X43JQXF3JK5/accept \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "invitation", "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "accepted", "accepted_at": "2021-06-27T19:07:33.155Z", "revoked_at": null, "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "accepted_user_id": "user_01JBJDMMV04RSWPG30MQE8ADFV", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Revokes an existing invitation.
curl --request POST \ --url https://api.workos.com/user_management/invitations/invitation_01E4ZCR3C56J083X43JQXF3JK5/revoke \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "invitation", "id": "invitation_01E4ZCR3C56J083X43JQXF3JK5", "email": "marcelina.davis@example.com", "state": "revoked", "accepted_at": null, "revoked_at": "2021-07-01T19:07:33.155Z", "expires_at": "2021-07-01T19:07:33.155Z", "token": "Z1uX3RbwcIl5fIGJJJCXXisdI", "accept_invitation_url": "https://your-app.com/invite?invitation_token=Z1uX3RbwcIl5fIGJJJCXXisdI", "organization_id": "org_01E4ZCR3C56J083X43JQXF3JK5", "inviter_user_id": "user_01HYGBX8ZGD19949T3BM4FW1C3", "accepted_user_id": null, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
curl https://api.workos.com/user_management/sessions/logout -G \ -d session_id=session_01HQAG1HENBZMAZD82YRXDFC0B \ -d return_to=https://your-app.com/signed-out
https://api.workos.com/user_management/sessions/logout? session_id=session_01HQAG1HENBZMAZD82YRXDFC0B&return_to=https%3A%2F%your-app.com%2Fsigned-out
GET/user_managementParameters Returns Generates the logout URL by extracting the session ID from the session cookie. Use this over getLogoutUrl if you don’t have a saved reference to the session ID and you’d like the SDK to handle extracting the session ID from the cookie for you.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_test_123'); const logoutUrl = workos.userManagement.getLogoutUrlFromSessionCookie({ sessionData: 'sealed_session_cookie_data', cookiePassword: 'password_previously_used_to_seal_session_cookie', });
https://api.workos.com/user_management/sessions/logout? session_id=session_01HQAG1HENBZMAZD82YRXDFC0B
userManagementParameters objectReturns CLI Auth enables command-line applications to authenticate users through the web using the OAuth 2.0 Device Authorization Flow.
The CLI Auth flow involves two main endpoints:
Read more about CLI Auth here.
Initiates the CLI Auth flow by requesting a device code and verification URLs. This endpoint implements the OAuth 2.0 Device Authorization Flow (RFC 8628) and is designed for command-line applications or other devices with limited input capabilities.
curl -X POST 'https://api.workos.com/user_management/authorize/device' \ -d client_id=client_123456789
{ "device_code": "CVE2wOfIFK4vhmiDBntpX9s8KT2f0qngpWYL0LGy9HxYgBRXUKIUkZB9BgIFho5h", "user_code": "BCDF-GHJK", "verification_uri": "https://<subdomain>.authkit.app/device", "verification_uri_complete": "https://<subdomain>.authkit.app/device?user_code=BCDF-GHJK", "expires_in": 300, "interval": 5 }
POST/user_managementParameters Returns Exchanges a device code for access and refresh tokens as part of the CLI Auth flow. This endpoint should be polled repeatedly until the user authorizes the request, declines it, or the device code expires.
curl -X POST 'https://api.workos.com/user_management/authenticate' \ -d 'grant_type=urn:ietf:params:oauth:grant-type:device_code' \ -d 'device_code=ETaHpDNhfxu0HyLhp6b8HGSh26NzYJSKw3TT6aS7HKKBhTyTD0zAW6ApTTolug0b' \ -d 'client_id=client_123456789'
{ "user": { "object": "user", "id": "user_01JYHX0DW7077GPTAY8MZVNMQX", "email": "grant.mccode@workos.com", "email_verified": true, "first_name": "Grant", "last_name": "McCode", "profile_picture_url": null, "last_sign_in_at": "2025-06-25T19:16:35.647Z", "created_at": "2025-06-25T01:20:21.355Z", "updated_at": "2025-06-25T19:16:35.647Z", "external_id": null }, "organization_id": "org_01JYHNPKWTD5DRGPJHNYBB1HB8", "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkdyYW50IE1jQ29kZSIsImFkbWluIjp0cnVlLCJpYXQiOjEzMzcsInBhc3N3b3JkIjoiaHVudGVyMiJ9.kcmTbx7M89k-3qUXN1UVcy9us6xdPZkDOqQ0UeY3Bws", "refresh_token": "RSzR4ngmJROKFJZQEpp5fNF4y", "authentication_method": "GoogleOAuth" }
POST/user_managementParameters Returns When polling the device code endpoint, you may receive various error responses before the user completes authorization or if authorization fails. These errors help your application understand the current state and take appropriate action.
Possible error codes and the corresponding descriptions are listed below.
| Error code | Description |
|---|---|
authorization_pending | The authorization request is still pending as the user hasn’t yet completed the user interaction flow. Continue polling at the specified interval. |
slow_down | The client is polling too frequently and should slow down. Increase your polling interval by at least 5 seconds and continue polling. |
access_denied | The user declined the authorization request. Stop polling and inform the user that authorization was denied. |
expired_token | The device code has expired (typically after 5 minutes). Stop polling and restart the authorization flow if needed. |
invalid_request | The request is missing a required parameter or includes an invalid parameter value. Check that grant_type, device_code, and client_id are provided and correct. |
invalid_client | Client authentication failed (e.g., unknown client, client authentication not included, or unsupported authentication method). |
invalid_grant | The provided device code is invalid, malformed, or has already been used. |
unsupported_grant_type | The grant type is not supported. Ensure you’re using urn:ietf:params:oauth:grant-type:device_code. |
All error responses are returned with a 400 status code and follow the OAuth 2.0 error response format. For example:
{ "error": "authorization_pending", "error_description": "The authorization request is still pending as the user hasn't yet completed the user interaction flow." }
The Single Sign-On API has been modeled to meet the OAuth 2.0 framework specification. As a result, authentication flows constructed using the Single Sign-On API replicate the OAuth 2.0 protocol flow.
To automatically respond to changes in your SSO connections, use the Connection events.
Generates an OAuth 2.0 authorization URL to authenticate a user with SSO.
curl https://api.workos.com/sso/authorize -G \ -d response_type=code \ -d client_id=client_123456789 \ -d redirect_uri=https://your-app.com/callback \ -d state=dj1kUXc0dzlXZ1hjUQ== \ -d connection=conn_01E4ZCR3C56J083X43JQXF3JK5
https://api.workos.com/sso/authorize? response_type=code& client_id=client_123456789& redirect_uri=https://your-app.com/callback& state=dj1kUXc0dzlXZ1hjUQ==& connection=conn_01E4ZCR3C56J083X43JQXF3JK5
GET/ssoReturns You’ll have to specify the user’s connection, organization, or OAuth provider as a parameter. These connection selectors are mutually exclusive, and exactly one must be provided. The generated URL automatically directs the user to their identity provider. Once the user authenticates with their identity provider, WorkOS then issues a redirect to your redirect URI to complete the sign-in flow.
In the OAuth 2.0 protocol, a redirect URI is the location that the user is redirected to once they have successfully authenticated with their identity provider.
When redirecting the user, WorkOS will generate an authorization code and pass it to your redirect URI as a code query parameter, your app will use this code to get the user’s profile. Additionally, WorkOS can pass a state parameter back to your application that you may use to encode arbitrary information to restore your application state between the redirects.
https://your-app.com/callback?code=01E2RJ4C05B52KKZ8FSRDAP23J&state=dj1kUXc0dzlXZ1hjUQ==
You’ll need to configure the allowed redirect URIs for your application via the Redirects page in the dashboard. Without a valid redirect URI, your users will be unable to sign in. Make sure that the redirect URI you use as a parameter to get the authorization URL matches one of the redirect URIs you have configured in the dashboard.
Redirect URIs follow stricter requirements in production environments:
HTTPS protocol is required in production environmentsHTTP and localhost are allowed in staging environmentsWorkOS supports using wildcard characters in Redirect URIs. The * symbol can be used as a wildcard for subdomains; however, it must be used in accordance with the following rules in order to properly function.
http://*.com will not work.https://sub.*.example.com will not work.https://*.*.example.com will not work.https://prefix-*-suffix.example.com will work.https://*.example.com will not work with https://sub1.sub2.example.com.https://*.ngrok-free.app will not work.A through Z, and a through z ); digits (0 through 9), hyphens (-), and underscores (_). For example, https://user:secret@foo.example.com will not work with https://*.example.com.If there is an issue generating an authorization URL, the API will return the original redirect URI with error and error_description query parameters. If provided, the state value will also be included.
https://your-app.com/callback?error=organization_invalid&error_description=No%20connection%20associated%20with%20organization&state=123456789
Possible error codes and the corresponding descriptions are listed below.
| Error code | Description |
|---|---|
access_denied | The user denied an OAuth authorization request at the identity provider. |
ambiguous_connection_selector | A connection could not be uniquely identified using the provided connection selector (e.g., organization). This can occur when there are multiple SSO connections under the same organization. If you need multiple SSO connections for an organization, use the connection parameter to identify which connection to use for SSO. |
connection_domain_invalid | There is no connection for the provided domain. |
connection_invalid | There is no connection for the provided ID. |
connection_strategy_invalid | The provider has multiple strategies associated per environment. |
connection_unlinked | The connection associated with the request is unlinked. |
domain_connection_selector_not_allowed | This is a legacy error code that only applies if using the deprecated “domain” query parameter which is no longer valid for this endpoint. Use the “organization” or “connection” query parameters to target a connection instead. |
invalid_connection_selector | A valid connection selector query parameter must be provided in order to correctly determine the proper connection to return an authorization URL for. Valid connection selectors are either connection, organization, or provider. |
organization_invalid | There is no organization matching the provided ID. |
oauth_failed | An OAuth authorization request failed for a user. |
profile_not_allowed_outside_organization | A profile was received that has an email that is outside the organization’s domain and the organization does not allow this. To resolve this, add the missing domain to the organization’s Domains. You can read about other options in the SSO Domains guide. |
server_error | The SSO authentication failed for the user. More detailed errors and steps to resolve are available in the Sessions tab on the connection page in the WorkOS Dashboard. |
A Profile is an object that represents an authenticated user. The Profile object contains information relevant to a user in the form of normalized attributes.
After receiving the Profile for an authenticated user, use the Profile object attributes to persist relevant data to your application’s user model for the specific, authenticated user.
No Profile attributes can be returned other than the normalized attributes listed below.
{ "object": "profile", "id": "prof_01DMC79VCBZ0NY2099737PSVF1", "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "connection_type": "OktaSAML", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "email": "todd@example.com", "first_name": "Todd", "last_name": "Rundgren", "idp_id": "00u1a0ufowBJlzPlk357", "role": { "slug": "admin" }, "raw_attributes": {} }
profileGet an access token along with the user Profile using the code passed to your Redirect URI.
curl -X POST "https://api.workos.com/sso/token" \ -d 'client_id=client_123456789' \ -d 'client_secret=sk_example_123456789' \ -d 'grant_type=authorization_code' \ -d 'code=01E2RJ4C05B52KKZ8FSRDAP23J'
{ "access_token": "01DMEK0J53CVMC32CK5SE0KZ8Q", "profile": { "object": "profile", "id": "prof_01DMC79VCBZ0NY2099737PSVF1", "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "connection_type": "OktaSAML", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "email": "todd@example.com", "first_name": "Todd", "last_name": "Rundgren", "idp_id": "00u1a0ufowBJlzPlk357", "role": { "slug": "admin" }, "raw_attributes": {} } }
POST/ssoParameters Returns objectExchange an access token for a user’s Profile. Because this profile is returned in the Get a Profile and Token endpoint your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user’s profile.
curl https://api.workos.com/sso/profile \ --header "Authorization: Bearer 01DMEK0J53CVMC32CK5SE0KZ8Q"
{ "object": "profile", "id": "prof_01DMC79VCBZ0NY2099737PSVF1", "connection_id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "connection_type": "OktaSAML", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "email": "todd@example.com", "first_name": "Todd", "last_name": "Rundgren", "idp_id": "00u1a0ufowBJlzPlk357", "role": { "slug": "admin" }, "raw_attributes": {} }
A connection represents the relationship between WorkOS and any collection of application users. This collection of application users may include personal or enterprise identity providers. As a layer of abstraction, a WorkOS connection rests between an application and its users, separating an application from the implementation details required by specific standards like OAuth 2.0 and SAML.
See the events reference documentation for the connection events.
{ "object": "connection", "id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "connection_type": "OktaSAML", "name": "Foo Corp", "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "connection_domain", "domain": "foo-corp.com" } ] }
connectionGet the details of an existing connection.
curl https://api.workos.com/connections/conn_01E2NPPCT7XQ2MVVYDHWGK1WN4 \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "connection", "id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "connection_type": "OktaSAML", "name": "Foo Corp", "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "domains": [ { "id": "org_domain_01EHZNVPK2QXHMVWCEDQEKY69A", "object": "connection_domain", "domain": "foo-corp.com" } ] }
Get a list of all of your existing connections matching the criteria specified.
curl https://api.workos.com/connections \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "object": "connection", "id": "conn_01E4ZCR3C56J083X43JQXF3JK5", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "connection_type": "GoogleOAuth", "name": "Foo Corp", "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:08:33.155Z" }, { "object": "connection", "id": "conn_01E2NPPCT7XQ2MVVYDHWGK1WN4", "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "connection_type": "OktaSAML", "name": "Example Co", "state": "active", "created_at": "2021-06-25T19:09:33.155Z", "updated_at": "2021-06-25T19:10:33.155Z" } ], "list_metadata": { "before": "conn_01E2NPPCT7XQ2MVVYDHWGK1WN4", "after": null } }
GET/connectionsParameters Returns objectPermanently deletes an existing connection. It cannot be undone.
curl --request DELETE \ --url https://api.workos.com/connections/conn_01E2NPPCT7XQ2MVVYDHWGK1WN4 \ --header "Authorization: Bearer sk_example_123456789"
DELETE/connectionsParameters Directory Sync allows you to connect with directory providers to inform your application of any changes in their users, groups, or access rules.
Using Directory Sync, one integration grants your application the ability to support multiple directory providers. Get real-time updates of any changes to the organization’s access rules, groups, and users by integrating webhooks into your application.
To automatically respond to changes in the connected directories and their users and groups, use the Directory Sync events.
A directory stores information about an organization’s employee management system.
Synchronizing with a directory enables you to receive changes to an organization’s user and group structure.
Directory providers vary in implementation details and may require different sets of fields for integration, such as API keys, subdomains, endpoints, usernames, etc. Where available, the WorkOS API will provide these fields when fetching directory records.
{ "id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "domain": "foo-corp.com", "name": "Foo Corp", "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "state": "unlinked", "type": "gsuite directory", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
directoryGet the details of an existing directory.
curl https://api.workos.com/directories/directory_01ECAZ4NV9QMV47GW873HDCX74 \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "domain": "foo-corp.com", "name": "Foo Corp", "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "state": "unlinked", "type": "gsuite directory", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" }
Get a list of all of your existing directories matching the criteria specified.
curl https://api.workos.com/directories?search=WorkOS \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "domain": "foo-corp.com", "name": "Foo Corp", "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT", "object": "directory", "state": "unlinked", "type": "gsuite directory", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:08:33.155Z" }, { "id": "directory_01E8CS3GSBEBZ1F1CZAEE3KHDG", "domain": "foo-corp.com", "external_key": "r3NDlInUnAe6i4wG", "name": "Foo Corp", "organization_id": "org_01EHZNVPK3SFK441A1RGBFPANT", "object": "directory", "state": "linked", "type": "okta scim v2.0", "created_at": "2021-06-25T19:09:33.155Z", "updated_at": "2021-06-25T19:10:33.155Z" } ], "list_metadata": { "after": "directory_01E1JJS84MFPPQ3G655FHTKX6Z", "before": "directory_01E1JJS84MFPPQ3G655FHTKX6Z" } }
GET/directoriesParameters Returns objectPermanently deletes an existing directory. It cannot be undone.
curl --request DELETE \ --url https://api.workos.com/directories/directory_01ECAZ4NV9QMV47GW873HDCX74 \ --header "Authorization: Bearer sk_example_123456789"
DELETE/directoriesParameters A Directory User represents an active organization user.
Developers can receive Webhooks as employees are added, updated or removed, allowing for provisioning and de-provisioning Users within an application.
{ "id": "directory_user_01E1JG7J09H96KYP8HM9B0G5SJ", "idp_id": "2836", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "first_name": "Marcelina", "last_name": "Davis", "email": "marcelina@example.com", "groups": [ { "id": "directory_group_01E64QTDNS0EGJ0FMCVY9BWGZT", "name": "Engineering", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "raw_attributes": {} } ], "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "custom_attributes": { "department": "Engineering", "job_title": "Software Engineer" }, "raw_attributes": {}, "role": { "slug": "member" } }
directory_userGet the details of an existing Directory User.
curl https://api.workos.com/directory_users/directory_user_01E1JG7J09H96KYP8HM9B0G5SJ \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "directory_user_01E1JG7J09H96KYP8HM9B0G5SJ", "idp_id": "2836", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "first_name": "Marcelina", "last_name": "Davis", "email": "marcelina@example.com", "groups": [ { "id": "directory_group_01E64QTDNS0EGJ0FMCVY9BWGZT", "name": "Engineering", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "raw_attributes": {} } ], "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "custom_attributes": { "department": "Engineering", "job_title": "Software Engineer" }, "raw_attributes": {}, "role": { "slug": "member" } }
Get a list of all of existing Directory Users matching the criteria specified.
curl https://api.workos.com/directory_users?directory=directory_01ECAZ4NV9QMV47GW873HDCX74 \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "id": "directory_user_01E1JJHG3BFJ3FNRRHSFWEBNCS", "idp_id": "1902", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "first_name": "Jan", "last_name": "Brown", "email": "jan@example.com", "groups": [ { "id": "directory_group_01E64QTDNS0EGJ0FMCVY9BWGZT", "name": "Engineering", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ], "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "custom_attributes": { "department": "Engineering", "job_title": "Software Engineer" }, "role": { "slug": "member" } }, { "id": "directory_user_01E1JJHG10ANRA2V6PAX3GD7TE", "idp_id": "8953", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "first_name": "Rosalinda", "last_name": "Swift", "email": "rosalinda@example.com", "groups": [ { "id": "directory_group_01E64QTDNS0EGJ0FMCVY9BWGZT", "name": "Engineering", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ], "state": "active", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "custom_attributes": { "department": "Engineering", "job_title": "Software Engineer" }, "role": { "slug": "member" } } ], "object": "list", "list_metadata": { "after": "directory_user_01E4RH82CC8QAP8JTRCTNDSS4C", "before": "directory_user_01E4RH828021B9ZZB8KH8E2Z1W" } }
GET/directory_userParameters Returns objectA directory group represents an organizational unit of users in a directory provider.
{ "id": "directory_group_01E1JJS84MFPPQ3G655FHTKX6Z", "idp_id": "02grqrue4294w24", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "name": "Developers", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "raw_attributes": {} }
directory_groupGet the details of an existing Directory Group.
curl https://api.workos.com/directory_groups/directory_group_01E1JJS84MFPPQ3G655FHTKX6Z \ --header "Authorization: Bearer sk_example_123456789"
{ "id": "directory_group_01E1JJS84MFPPQ3G655FHTKX6Z", "idp_id": "02grqrue4294w24", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "name": "Developers", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "raw_attributes": {} }
Get a list of all of existing directory groups matching the criteria specified.
curl https://api.workos.com/directory_groups?directory=directory_01ECAZ4NV9QMV47GW873HDCX74 \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "id": "directory_group_01E1JJS84MFPPQ3G655FHTKX6Z", "idp_id": "02grqrue4294w24", "directory_id": "directory_01ECAZ4NV9QMV47GW873HDCX74", "organization_id": "org_01EZTR6WYX1A0DSE2CYMGXQ24Y", "name": "Developers", "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z", "raw_attributes": {} } ], "list_metadata": { "after": "directory_group_01E1JJS84MFPPQ3G655FHTKX6Z", "before": "directory_group_01E1JJS84MFPPQ3G655FHTKX6Z" } }
GET/directory_groupsParameters Returns objectThe Admin Portal is a standalone application where your users can configure and manage WorkOS resources such as Connections and Directories that are scoped to their Organization.
A Portal Link is a temporary endpoint to initiate an Admin Portal session. It expires five minutes after issuance.
https://setup.workos.com?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
Generate a Portal Link scoped to an Organization.
curl --request POST \ --url https://api.workos.com/portal/generate_link \ --header "Authorization: Bearer sk_example_123456789" \ -d organization="org_01EHZNVPK3SFK441A1RGBFSHRT" \ -d intent="sso"
{ "link": "https://setup.workos.com?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." }
POST/portalParameters Returns objectIcons for third-party providers are available through the WorkOS CDN. These icons cover identity providers, Directory Sync, and domain verification services used within the Admin Portal.
Get a list of all of existing provider icons.
curl https://cdn.workos.com/provider-icons.json
{ "AccessPeopleHr": { "name": "Access People HR", "slug": "access-people-hr", "icon": { "light": "https://cdn.workos.com/provider-icons/light/access-people-hr.svg", "dark": "https://cdn.workos.com/provider-icons/dark/access-people-hr.svg" } }, "AdpOidc": { "name": "ADP", "slug": "adp", "icon": { "light": "https://cdn.workos.com/provider-icons/light/adp.svg", "dark": "https://cdn.workos.com/provider-icons/dark/adp.svg" } }, "AppleOAuth": { "name": "Apple OAuth", "slug": "apple", "icon": { "light": "https://cdn.workos.com/provider-icons/light/apple.svg", "dark": "https://cdn.workos.com/provider-icons/dark/apple.svg" } }, "Auth0SAML": { "name": "Auth0", "slug": "auth0", "icon": { "light": "https://cdn.workos.com/provider-icons/light/auth0.svg", "dark": "https://cdn.workos.com/provider-icons/dark/auth0.svg" } }, "AzureSAML": { "name": "Entra ID (Azure AD)", "slug": "azure", "icon": { "light": "https://cdn.workos.com/provider-icons/light/azure.svg", "dark": "https://cdn.workos.com/provider-icons/dark/azure.svg" } }, "BambooHR": { "name": "BambooHR", "slug": "bamboo-hr", "icon": { "light": "https://cdn.workos.com/provider-icons/light/bamboo-hr.svg", "dark": "https://cdn.workos.com/provider-icons/dark/bamboo-hr.svg" } }, "BitbucketOAuth": { "name": "Bitbucket OAuth", "slug": "bitbucket", "icon": { "light": "https://cdn.workos.com/provider-icons/light/bitbucket.svg", "dark": "https://cdn.workos.com/provider-icons/dark/bitbucket.svg" } }, "BreatheHr": { "name": "Breathe HR", "slug": "breathe-hr", "icon": { "light": "https://cdn.workos.com/provider-icons/light/breathe-hr.svg", "dark": "https://cdn.workos.com/provider-icons/dark/breathe-hr.svg" } }, "CasSAML": { "name": "CAS", "slug": "cas", "icon": { "light": "https://cdn.workos.com/provider-icons/light/cas.svg", "dark": "https://cdn.workos.com/provider-icons/dark/cas.svg" } }, "CezanneHr": { "name": "Cezanne HR", "slug": "cezanne-hr", "icon": { "light": "https://cdn.workos.com/provider-icons/light/cezanne-hr.svg", "dark": "https://cdn.workos.com/provider-icons/dark/cezanne-hr.svg" } }, "ClassLinkSAML": { "name": "ClassLink", "slug": "classlink", "icon": { "light": "https://cdn.workos.com/provider-icons/light/classlink.svg", "dark": "https://cdn.workos.com/provider-icons/dark/classlink.svg" } }, "CloudflareSAML": { "name": "Cloudflare", "slug": "cloudflare", "icon": { "light": "https://cdn.workos.com/provider-icons/light/cloudflare.svg", "dark": "https://cdn.workos.com/provider-icons/dark/cloudflare.svg" } }, "CyberArkSAML": { "name": "CyberArk", "slug": "cyberark", "icon": { "light": "https://cdn.workos.com/provider-icons/light/cyberark.svg", "dark": "https://cdn.workos.com/provider-icons/dark/cyberark.svg" } }, "Datadog": { "name": "Datadog", "slug": "datadog", "icon": { "light": "https://cdn.workos.com/provider-icons/light/datadog.svg", "dark": "https://cdn.workos.com/provider-icons/dark/datadog.svg" } }, "DuoSAML": { "name": "Duo", "slug": "duo", "icon": { "light": "https://cdn.workos.com/provider-icons/light/duo.svg", "dark": "https://cdn.workos.com/provider-icons/dark/duo.svg" } }, "Firebase": { "name": "Firebase", "slug": "firebase", "icon": { "light": "https://cdn.workos.com/provider-icons/light/firebase.svg", "dark": "https://cdn.workos.com/provider-icons/dark/firebase.svg" } }, "FourthHr": { "name": "Fourth", "slug": "fourth", "icon": { "light": "https://cdn.workos.com/provider-icons/light/fourth.svg", "dark": "https://cdn.workos.com/provider-icons/dark/fourth.svg" } }, "GithubOAuth": { "name": "GitHub OAuth", "slug": "github", "icon": { "light": "https://cdn.workos.com/provider-icons/light/github.svg", "dark": "https://cdn.workos.com/provider-icons/dark/github.svg" } }, "GitLabOAuth": { "name": "GitLab OAuth", "slug": "gitlab", "icon": { "light": "https://cdn.workos.com/provider-icons/light/gitlab.svg", "dark": "https://cdn.workos.com/provider-icons/dark/gitlab.svg" } }, "GoDaddy": { "name": "GoDaddy", "slug": "godaddy", "icon": { "light": "https://cdn.workos.com/provider-icons/light/godaddy.svg", "dark": "https://cdn.workos.com/provider-icons/dark/godaddy.svg" } }, "GoogleOAuth": { "name": "Google OAuth", "slug": "google", "icon": { "light": "https://cdn.workos.com/provider-icons/light/google.svg", "dark": "https://cdn.workos.com/provider-icons/dark/google.svg" } }, "GoogleWorkspace": { "name": "Google Workspace", "slug": "google-cloud", "icon": { "light": "https://cdn.workos.com/provider-icons/light/google-cloud.svg", "dark": "https://cdn.workos.com/provider-icons/dark/google-cloud.svg" } }, "Hibob": { "name": "Hibob", "slug": "hibob", "icon": { "light": "https://cdn.workos.com/provider-icons/light/hibob.svg", "dark": "https://cdn.workos.com/provider-icons/dark/hibob.svg" } }, "Intuit": { "name": "Intuit", "slug": "intuit", "icon": { "light": "https://cdn.workos.com/provider-icons/light/intuit.svg", "dark": "https://cdn.workos.com/provider-icons/dark/intuit.svg" } }, "JumpCloudSAML": { "name": "JumpCloud", "slug": "jumpcloud", "icon": { "light": "https://cdn.workos.com/provider-icons/light/jumpcloud.svg", "dark": "https://cdn.workos.com/provider-icons/dark/jumpcloud.svg" } }, "KeycloakSAML": { "name": "Keycloak", "slug": "keycloak", "icon": { "light": "https://cdn.workos.com/provider-icons/light/keycloak.svg", "dark": "https://cdn.workos.com/provider-icons/dark/keycloak.svg" } }, "LastPassSAML": { "name": "LastPass", "slug": "lastpass", "icon": { "light": "https://cdn.workos.com/provider-icons/light/lastpass.svg", "dark": "https://cdn.workos.com/provider-icons/dark/lastpass.svg" } }, "LinkedInOAuth": { "name": "LinkedIn OAuth", "slug": "linkedin", "icon": { "light": "https://cdn.workos.com/provider-icons/light/linkedin.svg", "dark": "https://cdn.workos.com/provider-icons/dark/linkedin.svg" } }, "LoginGovOidc": { "name": "Login.gov", "slug": "login-gov", "icon": { "light": "https://cdn.workos.com/provider-icons/light/login-gov.svg", "dark": "https://cdn.workos.com/provider-icons/dark/login-gov.svg" } }, "MicrosoftOAuth": { "name": "Microsoft OAuth", "slug": "microsoft", "icon": { "light": "https://cdn.workos.com/provider-icons/light/microsoft.svg", "dark": "https://cdn.workos.com/provider-icons/dark/microsoft.svg" } }, "MiniOrangeSAML": { "name": "miniOrange", "slug": "miniorange", "icon": { "light": "https://cdn.workos.com/provider-icons/light/miniorange.svg", "dark": "https://cdn.workos.com/provider-icons/dark/miniorange.svg" } }, "NetIqSAML": { "name": "NetIQ", "slug": "net-iq", "icon": { "light": "https://cdn.workos.com/provider-icons/light/net-iq.svg", "dark": "https://cdn.workos.com/provider-icons/dark/net-iq.svg" } }, "OktaSAML": { "name": "Okta", "slug": "okta", "icon": { "light": "https://cdn.workos.com/provider-icons/light/okta.svg", "dark": "https://cdn.workos.com/provider-icons/dark/okta.svg" } }, "OneLoginSAML": { "name": "OneLogin", "slug": "onelogin", "icon": { "light": "https://cdn.workos.com/provider-icons/light/onelogin.svg", "dark": "https://cdn.workos.com/provider-icons/dark/onelogin.svg" } }, "OracleSAML": { "name": "Oracle", "slug": "oracle", "icon": { "light": "https://cdn.workos.com/provider-icons/light/oracle.svg", "dark": "https://cdn.workos.com/provider-icons/dark/oracle.svg" } }, "Personio": { "name": "Personio", "slug": "personio", "icon": { "light": "https://cdn.workos.com/provider-icons/light/personio.svg", "dark": "https://cdn.workos.com/provider-icons/dark/personio.svg" } }, "PingFederateSAML": { "name": "PingFederate", "slug": "ping-identity", "icon": { "light": "https://cdn.workos.com/provider-icons/light/ping-identity.svg", "dark": "https://cdn.workos.com/provider-icons/dark/ping-identity.svg" } }, "ReactNativeExpo": { "name": "React Native Expo", "slug": "react-native-expo", "icon": { "light": "https://cdn.workos.com/provider-icons/light/react-native-expo.svg", "dark": "https://cdn.workos.com/provider-icons/dark/react-native-expo.svg" } }, "RipplingSAML": { "name": "Rippling", "slug": "rippling", "icon": { "light": "https://cdn.workos.com/provider-icons/light/rippling.svg", "dark": "https://cdn.workos.com/provider-icons/dark/rippling.svg" } }, "SalesforceSAML": { "name": "Salesforce", "slug": "salesforce", "icon": { "light": "https://cdn.workos.com/provider-icons/light/salesforce.svg", "dark": "https://cdn.workos.com/provider-icons/dark/salesforce.svg" } }, "ShibbolethGenericSAML": { "name": "Shibboleth", "slug": "shibboleth", "icon": { "light": "https://cdn.workos.com/provider-icons/light/shibboleth.svg", "dark": "https://cdn.workos.com/provider-icons/dark/shibboleth.svg" } }, "SimpleSamlPhpSAML": { "name": "SimpleSAMLphp", "slug": "simple-saml-php", "icon": { "light": "https://cdn.workos.com/provider-icons/light/simple-saml-php.svg", "dark": "https://cdn.workos.com/provider-icons/dark/simple-saml-php.svg" } }, "SlackOAuth": { "name": "Slack OAuth", "slug": "slack", "icon": { "light": "https://cdn.workos.com/provider-icons/light/slack.svg", "dark": "https://cdn.workos.com/provider-icons/dark/slack.svg" } }, "Splunk": { "name": "Splunk", "slug": "splunk", "icon": { "light": "https://cdn.workos.com/provider-icons/light/splunk.svg", "dark": "https://cdn.workos.com/provider-icons/dark/splunk.svg" } }, "Supabase": { "name": "Supabase", "slug": "supabase", "icon": { "light": "https://cdn.workos.com/provider-icons/light/supabase.svg", "dark": "https://cdn.workos.com/provider-icons/dark/supabase.svg" } }, "VMwareSAML": { "name": "VMware", "slug": "vmware", "icon": { "light": "https://cdn.workos.com/provider-icons/light/vmware.svg", "dark": "https://cdn.workos.com/provider-icons/dark/vmware.svg" } }, "Workday": { "name": "Workday", "slug": "workday", "icon": { "light": "https://cdn.workos.com/provider-icons/light/workday.svg", "dark": "https://cdn.workos.com/provider-icons/dark/workday.svg" } }, "XeroOAuth": { "name": "Xero OAuth", "slug": "xero", "icon": { "light": "https://cdn.workos.com/provider-icons/light/xero.svg", "dark": "https://cdn.workos.com/provider-icons/dark/xero.svg" } } }
To use an icon in your project, you can reference the CDN link directly. You can alternate between light and dark mode icons by changing the path in the URL or using CSS media queries.
<picture> <source srcset="https://cdn.workos.com/provider-icons/dark/okta.svg" media="(prefers-color-scheme: dark)" /> <img src="https://cdn.workos.com/provider-icons/light/okta.svg" alt="Okta icon" /> </picture>
You can change the icons to grayscale by adding the filter CSS property.
img { filter: grayscale(100%); }
Audit Logs are a collection of events that contain information relevant to notable actions taken by users in your application. Every event in the collection contains details regarding what kind of action was taken (action), who performed the action (actor), what resources were affected by the action (targets), and additional details of when and where the action took place.
Create an Audit Log Event.
curl --request POST \ --url https://api.workos.com/audit_logs/events \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ --header "Idempotency-Key: 884793cd-bef4-46cf-8790-e3d4957a09ce" \ -d @- <<BODY { "organization_id": "org_01EHWNCE74X7JSDV0X3SZ3KJNY", "event": { "action": "user.signed_in", "occurred_at": "2022-09-02T16:35:39.317Z", "version": 1, "actor": { "type": "user", "id": "user_TF4C5938", "metadata": { "role": "admin" } }, "targets": [ { "type": "user", "id": "user_98432YHF", "name": "Jon Smith" }, { "type": "team", "id": "team_J8YASKA2", "metadata": { "owner": "user_01GBTCQ2" } } ], "context": { "location": "123.123.123.123", "user_agent": "Chrome/104.0.0.0" }, "metadata": { "extra": "data" } } } BODY
POST/audit_logsParameters An object representing an Audit Log Schema.
{ "object": "audit_log_schema", "version": 1, "targets": [{ "type": "user" }], "actor": { "metadata": {} }, "metadata": {}, "created_at": "2024-10-14T15:09:44.537Z" }
audit_log_schemaCreates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the action does not exist, it will also be created.
curl --request POST \ --url https://api.workos.com/audit_logs/actions/user.viewed_invoice/schemas \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d @- <<BODY { "actor": { "metadata": { "type": "object", "properties": { "role": { "type": "string" } } } }, "targets": [ { "type": "invoice", "metadata": { "type": "object", "properties": { "status": { "type": "string" } } } } ], "metadata": { "type": "object", "properties": { "transactionId": { "type": "string" } } } } BODY
Get a list of all schemas for the Audit Logs action identified by :name.
curl https://api.workos.com/audit_logs/actions/user.viewed_invoice/schemas \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "list", "data": [ { "version": 1, "actor": { "metadata": { "type": "object", "properties": { "role": { "type": "string" } } } }, "targets": [ { "type": "invoice", "metadata": { "type": "object", "properties": { "status": { "type": "string" } } } } ], "metadata": { "type": "object", "properties": { "transactionId": { "type": "string" } } }, "updated_at": "2021-06-25T19:07:33.155Z" } ], "list_metadata": { "before": null, "after": null } }
GET/audit_logsParameters Returns objectGet a list of all Audit Log actions in the current environment.
curl https://api.workos.com/audit_logs/actions \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "list", "data": [ { "object": "audit_log_action", "name": "user.viewed_invoice", "schema": { "object": "audit_log_schema", "version": 1, "actor": { "metadata": { "type": "object", "properties": { "role": { "type": "string" } } } }, "targets": [ { "type": "invoice", "metadata": { "type": "object", "properties": { "status": { "type": "string" } } } } ], "metadata": { "type": "object", "properties": { "transactionId": { "type": "string" } } }, "updated_at": "2021-06-25T19:07:33.155Z" }, "created_at": "2021-06-25T19:07:33.155Z", "updated_at": "2021-06-25T19:07:33.155Z" } ], "list_metadata": { "before": null, "after": null } }
GET/audit_logsParameters Returns objectAn object representing an Audit Log Export.
{ "object": "audit_log_export", "id": "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V", "state": "ready", "url": "https://exports.audit-logs.com/audit-log-exports/export.csv", "created_at": "2022-09-02T17:14:57.094Z", "updated_at": "2022-09-02T17:14:57.094Z" }
audit_log_exportCreate an Audit Log Export.
curl --request POST \ --url https://api.workos.com/audit_logs/exports \ --header "Authorization: Bearer sk_example_123456789" \ -d organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT" \ -d range_start="2022-07-02T18:09:06.996Z" \ -d range_end="2022-09-02T18:09:06.996Z" \ -d 'actions[]=user.signed_in' \ -d 'actors[]=Jon Smith' \ -d 'targets[]=team'
{ "object": "audit_log_export", "id": "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V", "state": "ready", "url": "https://exports.audit-logs.com/audit-log-exports/export.csv", "created_at": "2022-09-02T17:14:57.094Z", "updated_at": "2022-09-02T17:14:57.094Z" }
Get an Audit Log Export.
curl https://api.workos.com/audit_logs/exports/audit_log_export_01GBZK5MP7TD1YCFQHFR22180V \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "audit_log_export", "id": "audit_log_export_01GBZK5MP7TD1YCFQHFR22180V", "state": "ready", "url": "https://exports.audit-logs.com/audit-log-exports/export.csv", "created_at": "2022-09-02T17:14:57.094Z", "updated_at": "2022-09-02T17:14:57.094Z" }
The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.
Get the configured event retention period for the given Organization.
curl https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/audit_logs_retention \ --header "Authorization: Bearer sk_example_123456789"
{ "retention_period_in_days": 30 }
GET/organizationsParameters Returns objectSet the event retention period for the given Organization.
curl --request PUT \ --url https://api.workos.com/organizations/org_01EHZNVPK3SFK441A1RGBFSHRT/audit_logs_retention \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ -d '{ "retention_period_in_days": 30 }'
{ "retention_period_in_days": 30 }
PUT/organizationsParameters Returns objectAn organization domain represents an organization’s domain. Domains can be verified to assert that an organization owns the configured domain which is accomplished through DNS TXT record verification.
To automatically respond to changes in the organization domains, use Domain Verification events.
{ "object": "organization_domain", "id": "org_domain_01HEJXJSTVEDT7T58BM70FMFET", "organization_id": "org_01EHT88Z8J8795GZNQ4ZP1J81T", "domain": "foo-corp.com", "state": "pending", "verification_strategy": "dns", "verification_token": "aW5HQ8Sgps1y3LQyrShsFRo3F" }
Get the details of an existing organization.
curl --request GET \ --url https://api.workos.com/organization_domains/org_domain_01HEJXJSTVEDT7T58BM70FMFET \ --header "Authorization: Bearer sk_example_123456789" \
{ "object": "organization_domain", "id": "org_domain_01HEJXJSTVEDT7T58BM70FMFET", "organization_id": "org_01EHT88Z8J8795GZNQ4ZP1J81T", "domain": "foo-corp.com", "state": "pending", "verification_strategy": "dns", "verification_token": "aW5HQ8Sgps1y3LQyrShsFRo3F" }
Creates a new Organization Domain.
curl --request POST \ --url https://api.workos.com/organization_domains \ --header "Authorization: Bearer sk_example_123456789" \ -d organization_id="org_01EHT88Z8J8795GZNQ4ZP1J81T" \ -d domain="foo-corp.com"
{ "object": "organization_domain", "id": "org_domain_01HEJXJSTVEDT7T58BM70FMFET", "organization_id": "org_01EHT88Z8J8795GZNQ4ZP1J81T", "domain": "foo-corp.com", "state": "pending", "verification_strategy": "dns", "verification_token": "aW5HQ8Sgps1y3LQyrShsFRo3F" }
Initiates verification process for an Organization Domain.
curl --request POST \ --url https://api.workos.com/organization_domains/org_domain_01HEJXJSTVEDT7T58BM70FMFET/verify \ --header "Authorization: Bearer sk_example_123456789" \
{ "object": "organization_domain", "id": "org_domain_01HEJXJSTVEDT7T58BM70FMFET", "organization_id": "org_01EHT88Z8J8795GZNQ4ZP1J81T", "domain": "foo-corp.com", "state": "pending", "verification_strategy": "dns", "verification_token": "oNKzjqppp347rDBgLA5dTo8uA" }
An object representing an Authentication Factor.
{ "object": "authentication_factor", "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ", "created_at": "2022-02-15T15:14:19.392Z", "updated_at": "2022-02-15T15:14:19.392Z", "type": "totp", "totp": { "qr_code": "data:image/png;base64,{base64EncodedPng}", "secret": "NAGCCFS3EYRB422HNAKAKY3XDUORMSRF", "uri": "otpauth://totp/FooCorp:alan.turing@example.com?secret=NAGCCFS3EYRB422HNAKAKY3XDUORMSRF&issuer=FooCorp" } }
authentication_factorAn object representing a Challenge of an Authentication Factor.
{ "object": "authentication_challenge", "id": "auth_challenge_01FVYZWQTZQ5VB6BC5MPG2EYC5", "created_at": "2022-02-15T15:26:53.274Z", "updated_at": "2022-02-15T15:26:53.274Z", "expires_at": "2022-02-15T15:36:53.279Z", "authentication_factor_id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ" }
authentication_challengeEnrolls an Authentication Factor to be used as an additional factor of authentication. The returned ID should be used to create an authentication Challenge.
curl --request POST \ --url https://api.workos.com/auth/factors/enroll \ --header "Authorization: Bearer sk_example_123456789" \ -d type="totp" \ -d totp_issuer="Foo Corp" \ -d totp_user="alan.turing@example.com"
{ "object": "authentication_factor", "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ", "created_at": "2022-02-15T15:14:19.392Z", "updated_at": "2022-02-15T15:14:19.392Z", "type": "totp", "totp": { "qr_code": "data:image/png;base64,{base64EncodedPng}", "secret": "NAGCCFS3EYRB422HNAKAKY3XDUORMSRF", "uri": "otpauth://totp/FooCorp:alan.turing@example.com?secret=NAGCCFS3EYRB422HNAKAKY3XDUORMSRF&issuer=FooCorp" } }
Creates a Challenge for an Authentication Factor.
curl --request POST \ --url https://api.workos.com/auth/factors/auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ/challenge \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "authentication_challenge", "id": "auth_challenge_01FVYZWQTZQ5VB6BC5MPG2EYC5", "created_at": "2022-02-15T15:26:53.274Z", "updated_at": "2022-02-15T15:26:53.274Z", "expires_at": "2022-02-15T15:36:53.279Z", "authentication_factor_id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ" }
Verify Authentication Challenge.
curl --request POST \ --url https://api.workos.com/auth/challenges/auth_challenge_01FVYZWQTZQ5VB6BC5MPG2EYC5/verify \ --header "Authorization: Bearer sk_example_123456789" \ -d code="123456"
{ "challenge": { "object": "authentication_challenge", "id": "auth_challenge_01FVYZWQTZQ5VB6BC5MPG2EYC5", "created_at": "2022-02-15T15:26:53.274Z", "updated_at": "2022-02-15T15:26:53.274Z", "expires_at": "2022-02-15T15:36:53.279Z", "authentication_factor_id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ" }, "valid": true }
POST/authParameters Returns objectGets an Authentication Factor.
curl https://api.workos.com/auth/factors/auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ \ --header "Authorization: Bearer sk_example_123456789"
{ "object": "authentication_factor", "id": "auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ", "created_at": "2022-02-15T15:14:19.392Z", "updated_at": "2022-02-15T15:14:19.392Z", "type": "totp", "totp": { "qr_code": "data:image/png;base64,{base64EncodedPng}", "secret": "NAGCCFS3EYRB422HNAKAKY3XDUORMSRF", "uri": "otpauth://totp/FooCorp:alan.turing@example.com?secret=NAGCCFS3EYRB422HNAKAKY3XDUORMSRF&issuer=FooCorp" } }
Permanently deletes an Authentication Factor. It cannot be undone.
curl --request DELETE \ --url https://api.workos.com/auth/factors/auth_factor_01FVYZ5QM8N98T9ME5BCB2BBMJ \ --header "Authorization: Bearer sk_example_123456789"
DELETE/authParameters Fine-Grained Authorization (FGA) is a set of APIs designed to help you implement scalable, centralized, fine grained authorization in your application.
Represents a type of resource and its possible relationships in your application. See Resource Types to learn more about relation rules. See JSON Syntax for more examples.
{ "type": "report", "relations": { "parent": {}, "owner": {}, "editor": { "inherit_if": "owner" }, "viewer": { "inherit_if": "any_of", "rules": [ { "inherit_if": "editor" }, { "inherit_if": "viewer", "of_type": "report", "with_relation": "parent" } ] } } }
resource_typeGet the definition of an existing resource type.
curl https://api.workos.com/fga/v1/resource-types/report \ --header "Authorization: Bearer sk_example_123456789"
{ "type": "report", "relations": { "owner": {}, "editor": { "inherit_if": "owner" }, "viewer": { "inherit_if": "editor" } } }
Get a list of all your existing resource types matching the criteria specified.
curl https://api.workos.com/fga/v1/resource-types \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "type": "role", "relations": { "owner": {}, "editor": { "inherit_if": "owner" }, "viewer": { "inherit_if": "editor" } } } ], "list_metadata": { "before": "eyJpZCI6IjY2YmMxMWEwLWVjYjktNDExMC1iNDI3LTIzZWRhMjBkODNkZCIsInZhbHVlIjoiMjAyMy0xMC0xN1QyMTo0NDoxNy4wNTM1NTJaIn0", "after": "eyJpZCI6ImRvY3VtZW50OkYzIiwidmFsdWUiOiIyMDIzLTEwLTE3VDIxOjQ0OjE2Ljc4OTc5OVoifQ" } }
GET/fgaParameters Returns Create a new resource type in the current environment.
curl "https://api.workos.com/fga/v1/resource-types" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "type": "report", "relations": { "parent": {}, "owner": {}, "editor": { "inherit_if": "owner" }, "viewer": { "inherit_if": "any_of", "rules": [ { "inherit_if": "editor" }, { "inherit_if": "viewer", "of_type": "report", "with_relation": "parent" } ] } } }'
{ "type": "report", "relations": { "parent": {}, "owner": {}, "editor": { "inherit_if": "owner" }, "viewer": { "inherit_if": "any_of", "rules": [ { "inherit_if": "editor" }, { "inherit_if": "viewer", "of_type": "report", "with_relation": "parent" } ] } } }
Update properties of a resource type.
curl "https://api.workos.com/fga/v1/resource-types/report" \ -X PUT \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "relations": { "parent": {}, "owner": {}, "editor": {}, "viewer": {} } }'
{ "type": "report", "relations": { "parent": {}, "owner": {}, "editor": {}, "viewer": {} } }
Deletes a resource type in the current environment.
curl --request DELETE \ --url https://api.workos.com/fga/v1/resource-types/report \ --header "Authorization: Bearer sk_example_123456789"
DELETE/fgaParameters Sets resource types in the current environment to match the provided resource types.
This endpoint performs a batch operation which will override your entire schema for the environment. Any existing resource types not included in the request will be deleted.
curl "https://api.workos.com/fga/v1/resource-types" \ -X PUT \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '[ { "type": "user", "relations": {} }, { "type": "role", "relations": { "member": { "allowed_types": ["user"] } } } ]'
[ { "type": "user", "relations": {} }, { "type": "role", "relations": { "member": { "allowed_types": ["user"] } } } ]
PUT/fgaParameters Returns Represents a relation between resources in your application.
{ "resource_type": "report", "resource_id": "23ft346", "relation": "editor", "subject": { "resource_type": "user", "resource_id": "15ads7823a9df7as433gk23dd" } }
warrantGet a list of all your existing warrants matching the criteria specified.
curl https://api.workos.com/fga/v1/warrants \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "resource_type": "role", "resource_id": "admin", "relation": "member", "subject": { "resource_type": "user", "resource_id": "tony-stark" }, "created_at": "2024-06-20T17:58:12.768762Z" } ], "list_metadata": { "before": null, "after": "eyJpZCI6IntcInBrXCI6XCJ0ZWFtXzAxSjBLWFNBVDgzMVYyM0JCN0QzQjNHMjc0fGVudmlyb25tZW50XzAxSjBLWFNBVkJRU0EzQzZHMjAwQVFCQUFIfHdhcnJhbnRcIixcInNrXCI6XCJyb2xlfGFkbWlufG1lbWJlcnx1c2VyfDEyfHwxNzE4ODcwMjkzODQ1NDUwXCJ9In0=" } }
GET/fgaParameters Returns Creates a new warrant in the current environment.
curl "https://api.workos.com/fga/v1/warrants" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "op": "create", "resource_type": "report", "resource_id": "23ft346", "relation": "editor", "subject": { "resource_type": "user", "resource_id": "15ads7823a9df7as433gk23dd" } }'
{ "warrant_token": "MjM0fDM0MzQyM3wyMTM0MzM0MzY0NQ==" }
POST/fgaParameters Returns objectDeletes a warrant in the current environment.
curl "https://api.workos.com/fga/v1/warrants" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "op": "delete", "resource_type": "report", "resource_id": "23ft346", "relation": "editor", "subject": { "resource_type": "user", "resource_id": "15ads7823a9df7as433gk23dd" } }'
{ "warrant_token": "MjM0fDM0MzQyM3wyMTM0MzM0MzY0NQ==" }
POST/fgaParameters Returns objectExecutes a batch of warrant writes in the current environment.
curl "https://api.workos.com/fga/v1/warrants" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '[ { "op": "delete", "resource_type": "report", "resource_id": "23ft346", "relation": "viewer", "subject": { "resource_type": "user", "resource_id": "15ads7823a9df7as433gk23dd" } }, { "op": "create", "resource_type": "report", "resource_id": "23ft346", "relation": "editor", "subject": { "resource_type": "user", "resource_id": "15ads7823a9df7as433gk23dd" } }, { "resource_type": "report", "resource_id": "46hn681", "relation": "editor", "subject": { "resource_type": "user", "resource_id": "15ads7823a9df7as433gk23dd" } } ]'
{ "warrant_token": "MjM0fDM0MzQyM3wyMTM0MzM0MzY0NQ==" }
POST/fgaParameters Returns Represents a resource in your application.
{ "resource_type": "user", "resource_id": "dkfi7a0s-784e-407e-a1ea-42a91d4c52b9" }
resourceGet an existing resource.
curl "https://api.workos.com/fga/v1/resources/user/d6ed6474-784e-407e-a1ea-42a91d4c52b9" \ -H "Authorization: Bearer sk_example_123456789"
{ "resource_type": "user", "resource_id": "d6ed6474-784e-407e-a1ea-42a91d4c52b9", "meta": { "email": "user@example.org" } }
Get a list of all your existing resources matching the criteria specified.
curl "https://api.workos.com/fga/v1/resources" \ -H "Authorization: Bearer sk_example_123456789"
{ "data": [ { "resource_type": "user", "resource_id": "newUser2", "meta": { "email": "email2@userid.com" } }, { "resource_type": "user", "resource_id": "email@userid.com", "meta": { "email": "email@userid.com" } }, { "resource_type": "user", "resource_id": "04a2f51d-f3ce-4fa7-8aa6-26cc802d236e" }, { "resource_type": "user", "resource_id": "user1" } ], "list_metadata": { "before": "eyJpZCI6IjY2YmMxMWEwLWVjYjktNDExMC1iNDI3LTIzZWRhMjBkODNkZCIsInZhbHVlIjoiMjAyMy0xMC0xN1QyMTo0NDoxNy4wNTM1NTJaIn0", "after": "eyJpZCI6ImRvY3VtZW50OkYzIiwidmFsdWUiOiIyMDIzLTEwLTE3VDIxOjQ0OjE2Ljc4OTc5OVoifQ" } }
GET/fgaParameters Returns Create a new resource in the current environment.
curl "https://api.workos.com/fga/v1/resources" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "resource_type": "user", "resource_id": "d6ed6474-784e-407e-a1ea-42a91d4c52b9" }'
{ "resource_type": "user", "resource_id": "d6ed6474-784e-407e-a1ea-42a91d4c52b9" }
Update the meta of an existing resource in the current environment.
curl "https://api.workos.com/fga/v1/resources/user/d6ed6474-784e-407e-a1ea-42a91d4c52b9" \ -X PUT \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "meta": { "email": "updated@email.com" } }'
{ "resource_type": "user", "resource_id": "d6ed6474-784e-407e-a1ea-42a91d4c52b9", "meta": { "email": "updated@email.com" } }
Deletes a resource in the current environment.
Deleting a resource will also delete all warrants where the resource is the resource or subject of the warrant.
curl "https://api.workos.com/fga/v1/resources/user/d6ed6474-784e-407e-a1ea-42a91d4c52b9" \ -X DELETE \ -H "Authorization: Bearer sk_example_123456789" \
DELETE/fgaParameters Create or delete up to 100 resources in one request.
curl "https://api.workos.com/fga/v1/resources/batch" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "op": "create", "resources": [ { "resource_type": "user", "resource_id": "user-1", "meta": { "email": "user1@example.com" } }, { "resource_type": "user", "resource_id": "user-2" }, { "resource_type": "user" } ] }'
{ "data": [ { "resource_type": "user", "resource_id": "user-1", "meta": { "email": "user1@example.com" } }, { "resource_type": "user", "resource_id": "user-2" }, { "resource_type": "user", "resource_id": "generated-user-id" } ] }
POST/fgaParameters Returns
curl "https://api.workos.com/fga/v1/resources/batch" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "op": "delete", "resources": [ { "resource_type": "user", "resource_id": "user-1" }, { "resource_type": "user", "resource_id": "user-2" }, { "resource_type": "user", "resource_id": "generated-user-id" } ] }'
{ "data": [ { "resource_type": "user", "resource_id": "user-1" }, { "resource_type": "user", "resource_id": "user-2" }, { "resource_type": "user", "resource_id": "generated-user-id" } ] }
POST/fgaParameters Returns Represents a policy that defines the access control rules for your application.
{ "name": "ip_equal", "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" }
policyGet the definition of an existing policy.
curl https://api.workos.com/fga/v1/policies/ip_equal \ --header "Authorization: Bearer sk_example_123456789"
{ "name": "ip_equal", "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" }
Get a list of all your existing policies matching the criteria specified.
curl https://api.workos.com/fga/v1/policies \ --header "Authorization: Bearer sk_example_123456789"
{ "data": [ { "name": "ip_equal", "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" } ], "list_metadata": { "before": "eyJpZCI6IjY2YmMxMWEwLWVjYjktNDExMC1iNDI3LTIzZWRhMjBkODNkZCIsInZhbHVlIjoiMjAyMy0xMC0xN1QyMTo0NDoxNy4wNTM1NTJaIn0", "after": "eyJpZCI6ImRvY3VtZW50OkYzIiwidmFsdWUiOiIyMDIzLTEwLTE3VDIxOjQ0OjE2Ljc4OTc5OVoifQ" } }
GET/fgaParameters Returns Create a new policy in the current environment.
curl "https://api.workos.com/fga/v1/policies" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "name": "ip_equal", "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" }'
{ "name": "ip_equal", "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" }
Update properties of a policy.
curl "https://api.workos.com/fga/v1/policies/ip_equal" \ -X PUT \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" } '
{ "name": "ip_equal", "description": "Check if the client IP is in the range 192.168.x.x", "language": "expr", "parameters": [ { "name": "clientIp", "type": "string" } ], "expression": "clientIp matches \"192\\\\.168\\\\..*\\\\..*\"" }
Deletes a policy in the current environment.
curl --request DELETE \ --url https://api.workos.com/fga/v1/policies/ip_equal \ --header "Authorization: Bearer sk_example_123456789"
DELETE/fgaParameters Check if a subject has a particular relation on a resource.
curl "https://api.workos.com/fga/v1/check" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "checks": [ { "resource_type": "report", "resource_id": "avk2837", "relation": "viewer", "subject": { "resource_type": "user", "resource_id": "5djfs6" } } ] }'
{ "result": "authorized", "is_implicit": "false" }
POST/fgaParameters Returns object
curl "https://api.workos.com/fga/v1/check" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "op": "allOf", "checks": [ { "resource_type": "report", "resource_id": "avk2837", "relation": "viewer", "subject": { "resource_type": "user", "resource_id": "5djfs6" } }, { "resource_type": "report", "resource_id": "lal2420", "relation": "viewer", "subject": { "resource_type": "user", "resource_id": "5djfs6" } } ] }'
{ "result": "authorized", "is_implicit": "false" }
POST/fgaParameters Returns objectExecutes a batch of checks and returns a list of results in a single operation.
curl "https://api.workos.com/fga/v1/check" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "op": "batch", "checks": [ { "resource_type": "report", "resource_id": "avk2837", "relation": "viewer", "subject": { "resource_type": "user", "resource_id": "5djfs6" } }, { "resource_type": "report", "resource_id": "slp1029", "relation": "viewer", "subject": { "resource_type": "user", "resource_id": "5djfs6" } } ] }'
[ { "result": "not_authorized", "is_implicit": "false" }, { "result": "authorized", "is_implicit": "false" } ]
POST/fgaParameters Returns Use the Query Language to list the set of subjects that have access to a particular resource or to list the set of resources a particular subject has access to.
curl "https://api.workos.com/fga/v1/query?q=select+pricing-tier,feature+where+user:12+is+member" \ -H "Authorization: Bearer sk_example_123456789"
{ "data": [ { "resource_type": "pricing-tier", "resource_id": "enterprise", "warrant": { "resource_type": "pricing-tier", "resource_id": "enterprise", "relation": "member", "subject": { "resource_type": "user", "resource_id": "12" } }, "is_implicit": false, "meta": { "name": "Enterprise", "description": "Grants customers access to the features in our Enterprise tier." } }, { "resource_type": "pricing-tier", "resource_id": "basic", "warrant": { "resource_type": "pricing-tier", "resource_id": "enterprise", "relation": "member", "subject": { "resource_type": "user", "resource_id": "12" } }, "is_implicit": true, "meta": { "name": "Basic", "description": "Grants customers access to the features in our Free tier." } }, { "resource_type": "feature", "resource_id": "analytics", "warrant": { "resource_type": "pricing-tier", "resource_id": "enterprise", "relation": "member", "subject": { "resource_type": "user", "resource_id": "12" } }, "is_implicit": true, "meta": { "name": "Analytics", "description": "Grants customers access to the Custom Analytics value-add feature." } } ], "list_metadata": { "before": "eyJpZCI6IjY2YmMxMWEwLWVjYjktNDExMC1iNDI3LTIzZWRhMjBkODNkZCIsInZhbHVlIjoiMjAyMy0xMC0xN1QyMTo0NDoxNy4wNTM1NTJaIn0", "after": "eyJpZCI6ImRvY3VtZW50OkYzIiwidmFsdWUiOiIyMDIzLTEwLTE3VDIxOjQ0OjE2Ljc4OTc5OVoifQ" } }
GET/fgaParameters Returns objectRepresents the authorization model in your FGA environment. Includes resource type definitions and policies that define how authorization checks are processed.
{ "version": "0.3", "resource_types": [ { "type": "user" }, { "type": "group", "relations": { "member": { "allowed_types": ["user"] } } }, { "type": "asset", "relations": { "service_manager": { "allowed_types": ["group"] }, "access_diagnostics": { "allowed_types": [], "inherit_if": "all_of", "rules": [ { "inherit_if": "member", "of_type": "group", "with_relation": "service_manager" }, { "policy": "is_in_geo_fence" } ] } } } ], "policies": { "is_in_geo_fence": { "parameters": [ { "name": "user_location", "type": "map" }, { "name": "geofence", "type": "map" } ], "expression": "user_location.lat >= geofence.min_lat && user_location.lat <= geofence.max_lat && user_location.lon >= geofence.min_lon && user_location.lon <= geofence.max_lon" } } }
Get the authorization model for your current environment.
curl https://api.workos.com/fga/v1/schema \ --header "Authorization: Bearer sk_example_123456789"
{ "version": "0.3", "resource_types": [ { "type": "user" }, { "type": "group", "relations": { "member": { "allowed_types": ["user"] } } }, { "type": "asset", "relations": { "service_manager": { "allowed_types": ["group"] }, "access_diagnostics": { "allowed_types": [], "inherit_if": "all_of", "rules": [ { "inherit_if": "member", "of_type": "group", "with_relation": "service_manager" }, { "policy": "is_in_geo_fence" } ] } } } ], "policies": { "is_in_geo_fence": { "parameters": [ { "name": "user_location", "type": "map" }, { "name": "geofence", "type": "map" } ], "expression": "user_location.lat >= geofence.min_lat && user_location.lat <= geofence.max_lat && user_location.lon >= geofence.min_lon && user_location.lon <= geofence.max_lon" } } }
GET/fgaReturns Sets resource types and policies in the current environment.
This endpoint performs a batch operation which will override your entire schema for the environment. Any existing resource types and policies not included in the request will be deleted.
curl "https://api.workos.com/fga/v1/schema" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ --data-raw \ '{ "resource_types": [ { "type": "user", "relations": {} }, { "type": "role", "relations": { "member": { "allowed_types": ["user"] } } } ], "policies": {} }'
{ "version": 0.2, "resource_types": [ { "type": "user", "relations": {} }, { "type": "role", "relations": { "member": { "allowed_types": ["user"] } } } ], "policies": {} }
Widgets are React components that provide complete functionality for common enterprise app workflows.
Generate a widget token scoped to an organization and user with the specified scopes.
curl --request POST \ --url https://api.workos.com/widgets/token \ --header "Authorization: Bearer sk_example_123456789" \ -d organization_id="org_01EHZNVPK3SFK441A1RGBFSHRT" \ -d user_id="usr_01EHZNVPK3SFK441A1RGBFSHRT" \ -d scopes="widgets:users-table:manage"
{ "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." }
POST/widgetsParameters Returns objectVault provides centralized encryption and storage of sensitive data such as API keys, database credentials, or personally identifiable information (PII). All data is encrypted using keys automatically provisioned based on the provided context of the object.
Represents an encrypted object stored by Vault.
{ "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "metadata": { "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "environment_id": "environment_example_23456789", "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" }, "key_id": "e2084ada-50c1-5f9a-b1c7-fa868d506e5a", "updated_at": "2025-02-21T12:04:09.165291Z", "updated_by": { "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "name": "Marcelina Davis" }, "version_id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X" }, "name": "secret-name", "value": "my secret value" }
objectCreate a new object, encrypted with the key(s) matching the provided key context.
curl "https://api.workos.com/vault/v1/kv" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ -H "Content-Type: application/json" \ --data-raw \ '{ "name": "secret-name", "value": "my secret value", "key_context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" } }'
{ "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" }, "environment_id": "environment_example_23456789", "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "key_id": "e2084ada-50c1-5f9a-b1c7-fa868d506e5a", "updated_at": "2025-02-21T12:04:09.165291Z", "updated_by": { "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "name": "Marcelina Davis" }, "version_id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X" }
POST/vaultParameters Returns Get an existing object. The stored value will be decrypted and returned.
curl "https://api.workos.com/vault/v1/kv/secret_51B0AC67C2FB4247AC5ABDDD3C701BDC" \ -H "Authorization: Bearer sk_example_123456789"
{ "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "name": "secret-name", "value": "my secret value", "metadata": { "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" }, "environment_id": "environment_example_23456789", "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "key_id": "e2084ada-50c1-5f9a-b1c7-fa868d506e5a", "updated_at": "2025-02-21T12:04:09.165291Z", "updated_by": { "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "name": "Marcelina Davis" }, "version_id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X" } }
Update the value for an object. The key context of the original object will be used to encrypt the new data.
curl "https://api.workos.com/vault/v1/kv/secret_51B0AC67C2FB4247AC5ABDDD3C701BDC" \ -X PUT \ -H "Authorization: Bearer sk_example_123456789" \ -H "Content-Type: application/json" \ --data-raw \ '{ "value": "my secret value", "version_check": ""Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X" }'
{ "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "name": "secret-name", "metadata": { "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" }, "environment_id": "environment_example_23456789", "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "key_id": "e2084ada-50c1-5f9a-b1c7-fa868d506e5a", "updated_at": "2025-02-21T12:04:09.165291Z", "updated_by": { "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "name": "Marcelina Davis" }, "version_id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X" } }
PUT/vaultParameters Returns Retrieve metadata about an object. The value itself is not returned.
curl "https://api.workos.com/vault/v1/kv/secret_51B0AC67C2FB4247AC5ABDDD3C701BDC/metadata" \ -H "Authorization: Bearer sk_example_123456789"
{ "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "name": "secret-name", "metadata": { "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" }, "environment_id": "environment_example_23456789", "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "key_id": "e2084ada-50c1-5f9a-b1c7-fa868d506e5a", "updated_at": "2025-02-21T12:04:09.165291Z", "updated_by": { "id": "user_01E4ZCR3C56J083X43JQXF3JK5", "name": "Marcelina Davis" }, "version_id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X" } }
GET/vaultParameters Returns Get list of object names stored in Vault.
curl https://api.workos.com/vault/v1/kv \ -H "Authorization: Bearer sk_example_123456789"
{ "data": [ { "id": "secret_51B0AC67C2FB4247AC5ABDDD3C701BDC", "name": "secret-name", "updated_at": "2025-02-21T12:04:09.000000Z" }, { "id": "secret_60B446F845B55648AA98CD584E1FBD44", "name": "another secret", "updated_at": "2025-02-21T15:12:23.000000Z" }, { "id": "secret_6FC121802E0E5A029350874EFB117886", "name": "org_abc123 pii", "updated_at": "2025-02-23T03:44:54.000000Z" } ], "list_metadata": { "before": "secret_6FC121802E0E5A029350874EFB117886", "after": null } }
GET/vaultParameters Returns objectPermanently delete an object.
curl "https://api.workos.com/vault/v1/kv/secret_51B0AC67C2FB4247AC5ABDDD3C701BDC" \ -X DELETE \ -H "Authorization: Bearer sk_example_123456789"
{ "success": true, "name": "secret-name" }
DELETE/vaultParameters Returns Represents a static version of an object stored by Vault.
{ "created_at": "2025-02-21T12:04:09.165291Z", "current_version": true, "etag": "\"62b747b941ceefd67dacc026724044e4\"", "id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X", "size": 271 }
Get list of versions for an object stored in Vault.
curl "https://api.workos.com/vault/v1/kv/secret_51B0AC67C2FB4247AC5ABDDD3C701BDC/versions" \ -H "Authorization: Bearer sk_example_123456789"
{ "data": [ { "created_at": "2025-02-21T12:04:09.165291Z", "current_version": true, "etag": "\"62b747b941ceefd67dacc026724044e4\"", "id": "Wq49AmJIR7QI0kSwfY9BZ6vNsOq6AO_X", "size": 271 }, { "created_at": "2025-02-04T02:07:31.264189Z", "current_version": false, "etag": "\"7283fe4ac9609be1686bc8e79486d212\"", "id": "PpVeG_pxIeFuHZ00_ZqcK1SaiPMK7mkr", "size": 230 } ], "list_metadata": { "before": "PpVeG_pxIeFuHZ00_ZqcK1SaiPMK7mkr", "after": null } }
GET/vaultParameters Returns objectThe key management APIs can be used to generate isolated encryption keys for local encryption and decryption operations.
Generate a data key for local encryption based on the provided key context.
The encrypted data key MUST be stored by the application, as it cannot be retrieved after generation.
curl "https://api.workos.com/vault/v1/keys/data-key" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ -H "Content-Type: application/json" \ --data-raw \ '{ "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" } }'
{ "id": "bf51ccec-78b4-5200-b383-35730e71ef61", "context": { "organization_id": "org_01EHZNVPK3SFK441A1RGBFSHRT" }, "data_key": "DR9idtey9MpMrA1VRFrz30HB1yNgL2PoHZyjAkFeWgg=", "encrypted_keys": "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJDU2OWYyNDdjLTFkY2QtNDQzMC04MjRmLWQ3N2MxZDNhZmU1NgF0NTY5ZjI0N2MtMWRjZC00NDMwLTgyNGYtZDc3YzFkM2FmZTU2pWvKMbiudRtpyjYexZCX/K9ggOEioUw2c0B62kEh+oj68uuAJQWNfPKTC+mapgJPxdnMKniKxzI7a6zmHgXTK7dSOmAzJBDhDgtEiaqyKTM=" }
POST/vaultParameters Returns objectDecrypt a data key that was previously encrypted using WorkOS Vault.
curl "https://api.workos.com/vault/v1/keys/decrypt" \ -X POST \ -H "Authorization: Bearer sk_example_123456789" \ -H "Content-Type: application/json" \ --data-raw \ '{ "keys": "V09TLkVLTS52MQBiZjUxY2NlYy03OGI0LTUyMDAtYjM4My0zNTczMGU3MWVmNjEBATEBJDU2OWYyNDdjLTFkY2QtNDQzMC04MjRmLWQ3N2MxZDNhZmU1NgF0NTY5ZjI0N2MtMWRjZC00NDMwLTgyNGYtZDc3YzFkM2FmZTU2pWvKMbiudRtpyjYexZCX/K9ggOEioUw2c0B62kEh+oj68uuAJQWNfPKTC+mapgJPxdnMKniKxzI7a6zmHgXTK7dSOmAzJBDhDgtEiaqyKTM=" }'
{ "id": "bf51ccec-78b4-5200-b383-35730e71ef61", "data_key": "DR9idtey9MpMrA1VRFrz30HB1yNgL2PoHZyjAkFeWgg=" }
POST/vaultParameters Returns objectPerform a local encryption option. A data key is generated based on the provided key context and used to encrypt the data. The operation happens locally and neither the plaintext nor encrypted data are sent over the network.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789'); await workos.vault.encrypt('keep it secret, keep it safe', { organizationId: 'org_01EHZNVPK3SFK441A1RGBFSHRT', });
"J/HGPfUVMxY1GGvViE3MDe31fOU9BuIUja0/ekDOraRaA3v13YRnwLvDWbnSPjWjzgFXT1MuRUtNLnYxAGQ0ZWNkYjkwLTMwZmMtNTYwYS04MGM0LWExYWQ2N2IyYjUzYwEBMQEkMDIxOTlmM2EtMjE4NS00ODg4LTkzNzgtZTA0ODAxOGRkN2M1AXQwMjE5OWYzYS0yMTg1LTQ4ODgtOTM3OC1lMDQ4MDE4ZGQ3YzWdnLz+Zc8ySzyfZYOVKmuz2k3rNFa6MAihjl9+5u6fiXOjmavMBUcSg0wLFDxznK0UToroLyHDaPOnpN8MTlKO8lN1Qz4KSCpQWawThmSIZ2wwwiR1jY3AOo9P/YygzE5v"
vaultParameters Returns Decrypt data that was previously encrypted with Vault. The data key in the ciphertext is decrypted using the Vault API and used to decrypt the remaining data. The decryption operations happen locally and neither the plaintext nor encrypted data are sent over the network.
import { WorkOS } from '@workos-inc/node'; const workos = new WorkOS('sk_example_123456789'); await workos.vault.decrypt( 'J/HGPfUVMxY1GGvViE3MDe31fOU9BuIUja0/ekDOraRaA3v13YRnwLvDWbnSPjWjzgFXT1MuRUtNLnYxAGQ0ZWNkYjkwLTMwZmMtNTYwYS04MGM0LWExYWQ2N2IyYjUzYwEBMQEkMDIxOTlmM2EtMjE4NS00ODg4LTkzNzgtZTA0ODAxOGRkN2M1AXQwMjE5OWYzYS0yMTg1LTQ4ODgtOTM3OC1lMDQ4MDE4ZGQ3YzWdnLz+Zc8ySzyfZYOVKmuz2k3rNFa6MAihjl9+5u6fiXOjmavMBUcSg0wLFDxznK0UToroLyHDaPOnpN8MTlKO8lN1Qz4KSCpQWawThmSIZ2wwwiR1jY3AOo9P/YygzE5v', );
"keep it secret, keep it safe"
vaultParameters Returns WorkOS Connect is a unified interface that simplifies authentication and authorization across customers, partners, and external SaaS tools.
Read more about how Connect integrates with AuthKit here.
When authenticating a user for a WorkOS Connect application, this is the endpoint they should be redirected to. If they’re not already logged in, the user will be redirected to the AuthKit login page. For a third-party application, the user will have to authorize the application’s access on their first access.
curl https://<subdomain>.authkit.app/oauth2/authorize -G \ -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ -d "nonce=4QWsQj7bUUkCXnoC" \ --data-urlencode "redirect_uri=https://app.example.com/callback" \ -d "response_type=code" \ --data-urlencode "scope=openid profile email offline_access" \ -d "state=GPc459ttUQhB9oPn"
https://<subdomain>.authkit.app?authkit_authorization_session_id=01JPXGD1R10QHJZHPGYS3DT952&redirect_uri=&https%3A%2F%2Fapp.example.com%2Fcallback&state=GPc459ttUQhB9oPn
GET/oauth2Parameters Returns This endpoint is called by WorkOS Connect Applications to get access tokens, ID tokens, and refresh tokens, depending on the grant_type provided when requested.
This endpoint is authenticated by providing the WorkOS Application’s client ID and client secret in the body of the request.
There are four grant types available:
Each is described in greater detail below.
Used by WorkOS Connect OAuth Applications to exchange an authorization code for access tokens, ID tokens, and refresh tokens.
curl -X POST https://<subdomain>.authkit.app/oauth2/token \ -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ -d "grant_type=authorization_code" \ -d "code=01JMGA70GA2W47M7Z53JG355GW" \ -d "redirect_uri=https://app.example.com/callback"
{ "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzAxSlBYTjZLQTc2MjJLSjRWUDgzWDFOVEtYIiwic2lkIjoiYXBwX2NvbnNlbnRfMDFKUFhONktBUVc4M0FNWFhZNVdYM1JIVEoiLCJqdGkiOiIwMUpQWE42S0ZHWlFZVzNBTTJERVZYODRZUyIsImV4cCI6MTc0MjYwNDg1MywiaWF0IjoxNzQyNjA0NTUzfQ.dsMI3PBp5LWGeUosFUYYLsjC78swFMI4EUVXW1LN7yd80hxLhAvCX6gKN2s9h13a1tkAX77PDI2PooEJ8RQyB-Zcp_wzdomHffjqCeL-YgGojuCUmgjOm9w7kwg86e81tcMBIX3y872pe9jg1HrVs0t_tJNjoLEKtSwm-Flegttyg7M5SikrHKzul0Jv6ovaXjN4RygDPH6Nbg7Ewag5UwYd9aQK7IRG2oXZPC6WjJx-boyRvwgAqJ5pCedRc2ta5-sb3KyrgS6Xb0S3y1KA57RiDvJdQp8z_wL2_4e6iwG00a7OwyorIDpxKl5kAJE_Fct71931lB4EmNsGkVLxoA", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJuYW1lIjoiTGVyb3kgSmVua2lucyIsImdpdmVuX25hbWUiOiJMZXJveSIsImZhbWlseV9uYW1lIjoiSmVua2lucyIsImVtYWlsIjoibGVyb3kuamVua2luc0BleGFtcGxlLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiZXhwIjoxNzQyNjA4MTUzLCJpYXQiOjE3NDI2MDQ1NTN9.UmZj238IIPPtjlc3xEUn_nkNPtw4d71pJLcVyN-0IhDwS1q4bLURIfaV5NdBOUCMmK-BKK5p9NtRUVx5iuTuokah1tQAvfY6dMYNBAD9LMpsv4dvFZMSJHbH9khgrpnLUdvPzTveNBHpmBK7WvZ5VGLlX3Mr-WuI28bvHPI112sNaa-A8gPU7joMgitq01d0raWkBf6XvcAODHD8qKdcS0p4xCnFHVZnfKtgpVDnQJXEFzZnCbcHhdJvaWaTbhLWuWlbIbi4bv-Za3aYAZ-SdcvqkQNWcAPnaj17qLEfY_nyjmiVSW6qkWuq_vJUBLFMmaMbJTYzAsUPAh17_cg24A", "refresh_token": "GCOzb87tq7LWpSMaBCjVHnJPH", "token_type": "bearer" }
POST/oauth2Parameters Returns objectThe access token for WorkOS Connect OAuth Applications contains the following claims.
{ "iss": "https://<subdomain>.authkit.app", "aud": "client_123456789", "sub": "user_01JQ0E27VT3MH79RY0FVA4QBP9", "sid": "app_consent_01JQ0E27WE4K1RCMH7Q094M1GJ", "jti": "01JQ0E27ZXE4XNHVP870S6PWYN", "exp": 1742698034, "iat": 1742697734 }
Access token JWTThe ID token, when requested with the openid scope, contains information about the user’s identity, like name and email address.
{ "iss": "https://<subdomain>.authkit.app", "aud": "client_01JP8BD0CZ401TDF9X54NT5ZEK", "sub": "user_01JQ0E27VT3MH79RY0FVA4QBP9", "name": "Leroy Jenkins", "given_name": "Leroy", "family_name": "Jenkins", "email": "leroy.jenkins@example.com", "email_verified": true, "nonce": "f39a8e47d2c9b6fa", "exp": 1742702581, "iat": 1742698981 }
ID token JWTUsed by WorkOS Connect OAuth Applications to exchange a refresh token for new access tokens and/or ID tokens. The refresh token is provided when the initial oauth2/authorize request is made with the offline_access scope.
The access token and ID tokens issued here are the same as those issued for the initial authorization_code grant.
curl -X POST https://<subdomain>.authkit.app/oauth2/token \ -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ -d "grant_type=refresh_token" \ -d "refresh_token=01JMGA70GA2W47M7Z53JG355GW" \ -d "scope=openid profile email"
{ "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlEwMDFSTTROMDAzMjJRWDhYMTJCSFFWIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzAxSlEwMDFSRFdaUUdNMEhIMTBZOUJIVlBUIiwic2lkIjoiYXBwX2NvbnNlbnRfMDFKUTAwMVJFM1pBV1g4NDIyWlJQUVY4RVEiLCJqdGkiOiIwMUpRMDAxUk1ZOUNCWkRaU01TUkNDMkc1RCIsImV4cCI6MTc0MjY4MzMzOCwiaWF0IjoxNzQyNjgzMDM4fQ.rCUvi2kpuQmm5hwSinVe_O0SJICY_31QQv4kLNP4nQP_iKrBzb11nBCYaIslJ7nLVIaVQtVZJiu7GSDZ2QAAy3V5LxeICvo52YoB2QMS6LYJz2E7j7jTeWM2yV26Xhg4NHp5ykw6WOG7F9CcoyLbbhbK1NqEs1uYxjlXFONiaQ4FSPl5wk60pXw2E4pzOt-SNpfbWxlJUk3q7pWdajkDmZTGtZdU9hyr1hDTsgJINjd8A7jNpcJeUhT3LQjy5cwhrTaLipQXwrQ0jdfTDnYKxPadrENvKAFGMfQ6BeVAxPKFOIz4loUQuSWt6oHcLpMuH6sEa4eNytW1lT6QdebVDw", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlEwMDFSTTROMDAzMjJRWDhYMTJCSFFWIn0.eyJuYW1lIjoiQm9iIER5bGFuIiwiZ2l2ZW5fbmFtZSI6IkJvYiIsImZhbWlseV9uYW1lIjoiRHlsYW4iLCJlbWFpbCI6ImJvYkBkeWxhbi5tdXNpYyIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiZXhwIjoxNzQyNjg2NjM4LCJpYXQiOjE3NDI2ODMwMzh9.oTQTWBccCPja8tLEaKqBT63RwydqOMuBFzFXSQcp2CG8EvASEfkoKZCmdhte7dsSm5TVksTo7FwsEYOlNbgn6UAlkYaROFJ-ag6HkRhi6yCrBE_1CC_RNvmxLv_HKbcROG7ELk9pNW7TIfVU92vFxxJ_1xrE69K6gfQpG2F00uMjbEv3wiBtZdPIBWDlLGNj3nSqDT04Raov3hcPlRLYxiz5i6Sb_3nsZf3wgBvbZt0l5R59SgGrC3rXDc_EQ6QgcTVjiuIuMouz8tr3L7DhQCQ0oQF8aeXyLzvKU-Rlnt0DW9eMTs1Al6ZTyQ4WO4A9WqOJL_-i10t_oL6-CIAcXw", "refresh_token": "symOF4HwC0Xt3sGAoJSrXlre5", "token_type": "bearer" }
POST/oauth2Parameters Returns objectUsed by WorkOS Connect M2M Applications to exchange the app’s credentials for access tokens.
curl -X POST https://<subdomain>.authkit.app/oauth2/token \ -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ -d "grant_type=client_credentials" \ -d "scope=openid profile email"
{ "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBaWlk3UVA3MTJKMUsyMkI0WlpIMUIzIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJqdGkiOiIwMUpQWlpZN0VCTlA1TjJBTjgxRVlaMkpGUyIsInN1YiI6ImNsaWVudF8wMUpQWlpZN0RYQkNINTcyNUpFQzZYWTZXViIsIm9yZ19pZCI6Im9yZ18wMUpQWlpZN0RNUDM3MlMwRDMzMzY5Wkg2RiIsImV4cCI6MTc0MjY4NjUyMiwiaWF0IjoxNzQyNjgyOTIyfQ.Mi8UdyWT6nRlkamfTmLTca281PtHSh5HO810ly89AaFuVO_zrK1nnLCkI-mGL5GHdBa86eiPoWVhbX-epr4t35VuYfNaBd4LeE3nsjTw1otu51WTCHksiJgMMGprRWB23jATICQyTxffpV4Imk5wbsb3kkBhaHCq3uCgwBEeg73w1lY20DBkAjWEXCwQZOdNw7bFxrVIImH1wZxfPjNhlmrthqzA8kXBC9uul7Io4Yy2fDCT-viDCLBBiRK-uckBMmfwREl7pb296Acthl4xfDJuFDBa9sXPs2ZgEnihNodJYne-ryXFj144-GQ5JX_ungXQSSUEuy-Nf9M5Rru1iQ", "expires_in": 3600, "token_type": "bearer" }
POST/oauth2Parameters Returns objectThe access token for WorkOS Connect M2M Applications contains the following claims.
{ "iss": "https://<subdomain>.authkit.app", "aud": "client_123456789", "sub": "user_01JQ0E27VT3MH79RY0FVA4QBP9", "sid": "app_consent_01JQ0E27WE4K1RCMH7Q094M1GJ", "jti": "01JQ0E27ZXE4XNHVP870S6PWYN", "exp": 1742698034, "iat": 1742697734 }
Access token JWTIndicates whether the given token (access token or refresh token) is valid and active. Additionally, it provides details about the token.
This endpoint is authenticated by provided the WorkOS Application’s client ID and client secret in the body of the request.
curl -X POST https://<subdomain>.authkit.app/oauth2/introspection \ -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ -d "token=eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzAxSlBYTjZLQTc2MjJLSjRWUDgzWDFOVEtYIiwic2lkIjoiYXBwX2NvbnNlbnRfMDFKUFhONktBUVc4M0FNWFhZNVdYM1JIVEoiLCJqdGkiOiIwMUpQWE42S0ZHWlFZVzNBTTJERVZYODRZUyIsImV4cCI6MTc0MjYwNDg1MywiaWF0IjoxNzQyNjA0NTUzfQ.dsMI3PBp5LWGeUosFUYYLsjC78swFMI4EUVXW1LN7yd80hxLhAvCX6gKN2s9h13a1tkAX77PDI2PooEJ8RQyB-Zcp_wzdomHffjqCeL-YgGojuCUmgjOm9w7kwg86e81tcMBIX3y872pe9jg1HrVs0t_tJNjoLEKtSwm-Flegttyg7M5SikrHKzul0Jv6ovaXjN4RygDPH6Nbg7Ewag5UwYd9aQK7IRG2oXZPC6WjJx-boyRvwgAqJ5pCedRc2ta5-sb3KyrgS6Xb0S3y1KA57RiDvJdQp8z_wL2_4e6iwG00a7OwyorIDpxKl5kAJE_Fct71931lB4EmNsGkVLxoA" \ -d "token_type_hint=access_token"
{ "active": true, "client_id": "client_01JP8BD0CZ401TDF9X54NT5ZEK", "iss": "https://<subdomain>.authkit.app", "aud": "client_123456789", "sub": "user_01JPXN6KA7622KJ4VP83X1NTKX", "sid": "app_consent_01JPXN6KAQW83AMXXY5WX3RHTJ", "jti": "01JPXN6KFGZQYW3AM2DEVX84YS", "exp": 1742604853, "iat": 1742604553, "token_type": "access_token" }
{ "active": true, "aud": "client_123456789", "client_id": "client_01JP8BD0CZ401TDF9X54NT5ZEK", "iss": "https://<subdomain>.authkit.app", "sub": "client_01JP8BD0CZ401TDF9X54NT5ZEK", "org_id": "org_01JJT1ZX4Y9BG603K4Q9SHZ1KW", "jti": "01JPXN6KFGZQYW3AM2DEVX84YS", "exp": 1742604853, "iat": 1742604553, "token_type": "access_token" }
{ "active": true, "client_id": "client_01JP8BD0CZ401TDF9X54NT5ZEK", "iss": "https://<subdomain>.authkit.app", "aud": "client_123456789", "sub": "user_01JPXN6KA7622KJ4VP83X1NTKX", "iat": 1742604553, "token_type": "refresh_token" }
{ "active": false }
POST/oauth2Parameters Returns objectProvides information about the User referenced by the access token’s sub claim. Which claims are returned depends on the scopes originally granted when the access token was issued.
This endpoint is authenticated by providing the previously acquired access token in the Authorization header.
curl -X POST https://<subdomain>.authkit.app/oauth2/userinfo \ -H "authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzAxSlBYTjZLQTc2MjJLSjRWUDgzWDFOVEtYIiwic2lkIjoiYXBwX2NvbnNlbnRfMDFKUFhONktBUVc4M0FNWFhZNVdYM1JIVEoiLCJqdGkiOiIwMUpQWE42S0ZHWlFZVzNBTTJERVZYODRZUyIsImV4cCI6MTc0MjYwNDg1MywiaWF0IjoxNzQyNjA0NTUzfQ.dsMI3PBp5LWGeUosFUYYLsjC78swFMI4EUVXW1LN7yd80hxLhAvCX6gKN2s9h13a1tkAX77PDI2PooEJ8RQyB-Zcp_wzdomHffjqCeL-YgGojuCUmgjOm9w7kwg86e81tcMBIX3y872pe9jg1HrVs0t_tJNjoLEKtSwm-Flegttyg7M5SikrHKzul0Jv6ovaXjN4RygDPH6Nbg7Ewag5UwYd9aQK7IRG2oXZPC6WjJx-boyRvwgAqJ5pCedRc2ta5-sb3KyrgS6Xb0S3y1KA57RiDvJdQp8z_wL2_4e6iwG00a7OwyorIDpxKl5kAJE_Fct71931lB4EmNsGkVLxoA"
{ "sub": "user_01JQ0E27VT3MH79RY0FVA4QBP9", "name": "Leroy Jenkins", "given_name": "Leroy", "family_name": "Jenkins", "email": "leroy.jenkins@example.com", "email_verified": true }
POST/oauth2Returns Connect exposes several metadata endpoints in order to be compatible with a wide array of clients that support discovery and automatic configuration.
This discovery endpoint provides the standard configuration for OpenID clients to interact with WorkOS Connect.
curl https://<subdomain>.authkit.app/.well-known/openid-configuration
{ "issuer": "https://<subdomain>.authkit.app", "authorization_endpoint": "https://<subdomain>.authkit.app/oauth2/authorize", "grant_types_supported": [ "authorization_code", "client_credentials", "refresh_token" ], "id_token_signing_alg_values_supported": ["RS256"], "introspection_endpoint": "https://<subdomain>.authkit.app/oauth2/introspection", "jwks_uri": "https://<subdomain>.authkit.app/oauth2/jwks", "response_types_supported": ["code"], "subject_types_supported": ["public"], "token_endpoint": "https://<subdomain>.authkit.app/oauth2/token", "userinfo_endpoint": "https://<subdomain>.authkit.app/oauth2/userinfo" }
GET/.well-knownReturns objectThis endpoint provides RFC 6749-compatible OAuth Authorization Server metadata.
Model Context Protocol (MCP) clients that support the latest version of the specification use this endpoint. Read more here about how to use AuthKit as an authorization server for an MCP server.
curl https://<subdomain>.authkit.app/.well-known/oauth-authorization-server
{ "authorization_endpoint": "https://<subdomain>.authkit.app/oauth2/authorize", "code_challenge_methods_supported": ["S256"], "grant_types_supported": ["authorization_code", "refresh_token"], "introspection_endpoint": "https://<subdomain>.authkit.app/oauth2/introspection", "issuer": "https://<subdomain>.authkit.app", "registration_endpoint": "https://<subdomain>.authkit.app/oauth2/register", "scopes_supported": ["email", "offline_access", "openid", "profile"], "response_modes_supported": ["query"], "response_types_supported": ["code"], "token_endpoint": "https://<subdomain>.authkit.app/oauth2/token", "token_endpoint_auth_methods_supported": [ "none", "client_secret_post", "client_secret_basic" ] }
GET/.well-knownReturns objectCLI Auth for WorkOS Connect enables third-party applications to build command-line tools that integrate with your app’s credentials using the OAuth 2.0 Device Authorization Flow.
The CLI Auth flow for Connect involves two main endpoints:
Read more about CLI Auth here.
Initiates the device authorization flow for WorkOS Connect applications. This endpoint implements the OAuth 2.0 Device Authorization Flow and is designed for CLI applications and other devices with limited input capabilities.
This endpoint is used by third-party applications to authenticate users through WorkOS Connect. Users will be prompted to authorize the application’s access to their data as part of the consent flow.
curl -X POST 'https://<subdomain>.authkit.app/oauth2/device_authorization' \ -d 'client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK' \ --data-urlencode 'scope=openid profile email'
{ "device_code": "ETaHpDNhfxu0HyLhp6b8HGSh26NzYJSKw3TT6aS7HKKBhTyTD0zAW6ApTTolug0b", "user_code": "BCDF-GHJK", "verification_uri": "https://<subdomain>.authkit.app/device", "verification_uri_complete": "https://<subdomain>.authkit.app/device?user_code=BCDF-GHJK", "expires_in": 300, "interval": 5 }
POST/oauth2Parameters Returns Exchanges a device code for access and refresh tokens as part of the device authorization flow for WorkOS Connect applications. This endpoint should be polled repeatedly until the user authorizes the request, declines it, or the device code expires.
curl -X POST 'https://<subdomain>.authkit.app/oauth2/token' \ -d 'grant_type=urn:ietf:params:oauth:grant-type:device_code' \ -d 'device_code=ETaHpDNhfxu0HyLhp6b8HGSh26NzYJSKw3TT6aS7HKKBhTyTD0zAW6ApTTolug0b' \ -d 'client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK'
{ "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzAxSlBYTjZLQTc2MjJLSjRWUDgzWDFOVEtYIiwic2lkIjoiYXBwX2NvbnNlbnRfMDFKUFhONktBUVc4M0FNWFhZNVdYM1JIVEoiLCJqdGkiOiIwMUpQWE42S0ZHWlFZVzNBTTJERVZYODRZUyIsImV4cCI6MTc0MjYwNDg1MywiaWF0IjoxNzQyNjA0NTUzfQ.dsMI3PBp5LWGeUosFUYYLsjC78swFMI4EUVXW1LN7yd80hxLhAvCX6gKN2s9h13a1tkAX77PDI2PooEJ8RQyB-Zcp_wzdomHffjqCeL-YgGojuCUmgjOm9w7kwg86e81tcMBIX3y872pe9jg1HrVs0t_tJNjoLEKtSwm-Flegttyg7M5SikrHKzul0Jv6ovaXjN4RygDPH6Nbg7Ewag5UwYd9aQK7IRG2oXZPC6WjJx-boyRvwgAqJ5pCedRc2ta5-sb3KyrgS6Xb0S3y1KA57RiDvJdQp8z_wL2_4e6iwG00a7OwyorIDpxKl5kAJE_Fct71931lB4EmNsGkVLxoA", "expires_in": 3600, "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJuYW1lIjoiTGVyb3kgSmVua2lucyIsImdpdmVuX25hbWUiOiJMZXJveSIsImZhbWlseV9uYW1lIjoiSmVua2lucyIsImVtYWlsIjoibGVyb3kuamVua2luc0BleGFtcGxlLmNvbSIsImVtYWlsX3ZlcmlmaWVkIjpmYWxzZSwiZXhwIjoxNzQyNjA4MTUzLCJpYXQiOjE3NDI2MDQ1NTN9.UmZj238IIPPtjlc3xEUn_nkNPtw4d71pJLcVyN-0IhDwS1q4bLURIfaV5NdBOUCMmK-BKK5p9NtRUVx5iuTuokah1tQAvfY6dMYNBAD9LMpsv4dvFZMSJHbH9khgrpnLUdvPzTveNBHpmBK7WvZ5VGLlX3Mr-WuI28bvHPI112sNaa-A8gPU7joMgitq01d0raWkBf6XvcAODHD8qKdcS0p4xCnFHVZnfKtgpVDnQJXEFzZnCbcHhdJvaWaTbhLWuWlbIbi4bv-Za3aYAZ-SdcvqkQNWcAPnaj17qLEfY_nyjmiVSW6qkWuq_vJUBLFMmaMbJTYzAsUPAh17_cg24A", "refresh_token": "GCOzb87tq7LWpSMaBCjVHnJPH", "token_type": "bearer" }
POST/oauth2Parameters Returns The returned tokens are similar to those provided by the authorization code grant.
Radar allows you to detect, verify, and block harmful behavior in real time. The Radar API supports the management of WorkOS Radar block and allow lists as well as standalone Radar use-cases. While Radar is natively integrated with AuthKit, you can also leverage Radar’s risk decisioning engine outside of AuthKit to detect fraudulent sign-in and signup attempts in your own custom authentication flows using the attempts API.
The Radar standalone API is currently in preview, contact us to request access.
A Radar attempt represents a sign-in or signup attempt and includes context such as IP address and user agent. The Radar engine assesses attempts for risk and returns a decision that you can use to drive behavior in your application.
Evaluates an authentication attempt based on the parameters provided and returns a verdict.
curl https://api.workos.com/radar/attempts \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ --request POST \ --data '{ "ip_address": "192.168.1.1", "user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36", "email": "test@example.com", "auth_method": "Password", "action": "signup" }'
{ "verdict": "block", "reason": "detected_enabled_radar_control", "control": "bot_detection", "attempt_id": "01E4ZCR3C56J083X43JQXF3JK5" }
POST/radarReturns You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel.
curl https://api.workos.com/radar/attempts/01E4ZCR3C56J083X43JQXF3JK5 \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ --request PUT \ --data '{ "attempt_status": "success" }'
PUT/radarParameters Radar supports explicitly blocking and allowing attempts based on attempt attributes. You can manage these lists via the Radar list management APIs
Adds an entry to a Radar list
curl https://api.workos.com/radar/list/ip_address/block \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ --request POST \ --data '{ "entry": "49.78.240.97" }'
POST/radarParameters Removes an entry from a Radar list
curl https://api.workos.com/radar/list/ip_address/block \ --header "Authorization: Bearer sk_example_123456789" \ --header "Content-Type: application/json" \ --request DELETE \ --data '{ "entry": "49.78.240.97" }'
DELETE/radarParameters Deprecated API: Magic Link has been replaced by the AuthKit Magic Auth API.
The Magic Link API can be used to add Passwordless Authentication to your app.
An object representing a passwordless authentication session.
{ "object": "passwordless_session", "id": "passwordless_session_01EHDAK2BFGWCSZXP9HGZ3VK8C", "email": "marcelina@example.com", "expires_at": "2020-08-13T05:50:00.000Z", "link": "https://auth.workos.com/passwordless/4TeRexuejWCKs9rrFOIuLRYEr/confirm" }
passwordless_sessionCreate a Passwordless Session for a Magic Link Connection.
curl --request POST \ --url https://api.workos.com/passwordless/sessions \ --header "Authorization: Bearer sk_example_123456789" \ -d email="marcelina@example.com" \ -d type="MagicLink"
{ "object": "passwordless_session", "id": "passwordless_session_01EHDAK2BFGWCSZXP9HGZ3VK8C", "email": "marcelina@example.com", "expires_at": "2020-08-13T05:50:00.000Z", "link": "https://auth.workos.com/passwordless/4TeRexuejWCKs9rrFOIuLRYEr/confirm" }
Email a user the Magic Link confirmation URL.
curl --request POST \ --url https://api.workos.com/passwordless/sessions/passwordless_session_01EG1BHJMVYMFBQYZTTC0N73CR/send \ --header "Authorization: Bearer sk_example_123456789"
{ "success": true }
POSTSends email/passwordlessParameters Returns object