WorkOS

Name: WorkOS
Author: workos

Enterprise-ready authentication and user management. Manage organizations, users, SSO connections, directory sync, audit logs, fine-grained authorization, and feature flags.

ERP

该来源不提供完整文件导出（国内平台多为平台内托管），仅存元数据与原链

模型生成摘要（rules/v1 · 2026-10-01 13:09）：Enterprise-ready authentication and user management
这是模型对公开材料的总结，不是官方声明，请以原链内容为准。

接入信息

传输形态: http
鉴权方式: 需 API Key（探测：需要鉴权（HTTP 401））
端点: https://workos.run.tools

该服务需要凭证，请按官方文档申请后替换占位符

{
  "mcpServers": {
    "WorkOS": {
      "headers": {
        "Authorization": "Bearer \u003cYOUR_KEY\u003e"
      },
      "url": "https://workos.run.tools"
    }
  }
}

能力清单

工具	说明
api_keys.validations.create	Validate an API key value and return the API key object if valid.
audit_logs.actions.list	Get a list of all Audit Log actions in the current environment.
audit_logs.actions.schemas.list	Get a list of all schemas for the Audit Logs action identified by `:name`.
audit_logs.actions.schemas.create	Creates a new Audit Log schema used to validate the payload of incoming Audit Log Events. If the `action` does not exist, it will also be created.
audit_logs.events.create	Create an Audit Log Event. This API supports idempotency which guarantees that performing the same operation multiple times will have the same result as if the operation were performed only once. This is handy in situations where you may need to retry a request due to a failure or prevent accidental duplicate requests from creating more than one resource. To achieve idempotency, you can add `Idempotency-Key` request header to a Create Event request with a unique string as the value. Each subsequent request matching this unique string will return the same response. We suggest using [v4 UUIDs](https://en.wikipedia.org/wiki/Universally_unique_identifier) for idempotency keys to avoid collisions. Idempotency keys expire after 24 hours. The API will generate a new response if you submit a request with an expired key.
audit_logs.exports.create	Create an Audit Log Export. Exports are scoped to a single organization within a specified date range.
audit_logs.exports.get	Get an Audit Log Export. The URL will expire after 10 minutes. If the export is needed again at a later time, refetching the export will regenerate the URL.
auth.factors.get	Gets an Authentication Factor.
auth.factors.delete	Permanently deletes an Authentication Factor. It cannot be undone.
authorization.organization_memberships.check.create	Check if an organization membership has a specific permission on a resource. Supports identification by resource_id OR by resource_external_id + resource_type_slug.
authorization.organization_memberships.resources.list	Returns all child resources of a parent resource where the organization membership has a specific permission. This is useful for resource discovery—answering "What projects can this user access in this workspace?" You must provide either `parent_resource_id` or both `parent_resource_external_id` and `parent_resource_type_slug` to identify the parent resource.
authorization.organization_memberships.role_assignments.list	List all role assignments for an organization membership. This returns all roles that have been assigned to the user on resources, including organization-level and sub-resource roles.
authorization.organization_memberships.role_assignments.create	Assign a role to an organization membership on a specific resource.
authorization.organization_memberships.role_assignments.by_organization_membership_id.delete	Remove a role assignment by role slug and resource.
authorization.organization_memberships.role_assignments.delete	Remove a role assignment using its ID.
authorization.organizations.roles.list	Get a list of all roles that apply to an organization. This includes both environment roles and organization-specific roles, returned in priority order.
authorization.organizations.roles.create	Create a new custom organization role. When slug is omitted, it is auto-generated from the role name.
authorization.organizations.roles.get	Retrieve a role that applies to an organization by its slug. This can return either an environment role or an organization-specific role.
authorization.organizations.roles.update	Update an existing custom organization role. Only the fields provided in the request body will be updated.
authorization.organizations.roles.delete	Delete an existing custom organization role.
authorization.organizations.roles.permissions.create	Add a single permission to an organization role. If the permission is already assigned to the role, this operation has no effect.
authorization.organizations.roles.permissions.update	Replace all permissions on a role with the provided list.
authorization.organizations.roles.permissions.delete	Remove a single permission from an organization role by its slug.
authorization.organizations.resources.get	Retrieve the details of an authorization resource by its external ID, organization, and resource type. This is useful when you only have the external ID from your system and need to fetch the full resource details.
authorization.organizations.resources.update	Update an existing authorization resource using its external ID.
authorization.organizations.resources.delete	Delete an authorization resource by organization, resource type, and external ID. This also deletes all descendant resources.
authorization.organizations.resources.organization_memberships.list	Returns all organization memberships that have a specific permission on a resource, using the resource's external ID. This is useful for answering "Who can access this resource?" when you only have the external ID.
authorization.permissions.list	Get a list of all permissions in your WorkOS environment.
authorization.permissions.create	Create a new permission in your WorkOS environment. The permission can then be assigned to environment roles and organization roles.
authorization.permissions.get	Retrieve a permission by its unique slug.
authorization.permissions.update	Update an existing permission. Only the fields provided in the request body will be updated.
authorization.permissions.delete	Delete an existing permission. System permissions cannot be deleted.
authorization.resources.list	Get a paginated list of authorization resources.
authorization.resources.create	Create a new authorization resource.
authorization.resources.get	Retrieve the details of an authorization resource by its ID.
authorization.resources.update	Update an existing authorization resource.
authorization.resources.delete	Delete an authorization resource and all its descendants.
authorization.resources.organization_memberships.list	Returns all organization memberships that have a specific permission on a resource instance. This is useful for answering "Who can access this resource?".
authorization.roles.list	List all environment roles in priority order.
authorization.roles.create	Create a new environment role.
authorization.roles.get	Get an environment role by its slug.
authorization.roles.update	Update an existing environment role.
authorization.roles.permissions.create	Add a single permission to an environment role. If the permission is already assigned to the role, this operation has no effect.
authorization.roles.permissions.update	Replace all permissions on an environment role with the provided list.
connect.applications.list	List all Connect Applications in the current environment with optional filtering.
connect.applications.create	Create a new Connect Application. Supports both OAuth and Machine-to-Machine (M2M) application types.
connect.applications.get	Retrieve details for a specific Connect Application by ID or client ID.
connect.applications.update	Update an existing Connect Application. For OAuth applications, you can update redirect URIs. For all applications, you can update the name, description, and scopes.
connect.applications.delete	Delete an existing Connect Application.
connections.list	Get a list of all of your existing connections matching the criteria specified.
connections.get	Get the details of an existing connection.
connections.delete	Permanently deletes an existing connection. It cannot be undone.
directories.list	Get a list of all of your existing directories matching the criteria specified.
directories.get	Get the details of an existing directory.
directories.delete	Permanently deletes an existing directory. It cannot be undone.
directory_groups.list	Get a list of all of existing directory groups matching the criteria specified.
directory_groups.get	Get the details of an existing Directory Group.
directory_users.list	Get a list of all of existing Directory Users matching the criteria specified.
directory_users.get	Get the details of an existing Directory User.
events.list	List events for the current environment.
feature_flags.list	Get a list of all of your existing feature flags matching the criteria specified.
feature_flags.get	Get the details of an existing feature flag by its slug.
feature_flags.disable.update	Disables a feature flag in the current environment.
feature_flags.enable.update	Enables a feature flag in the current environment.
feature_flags.targets.create	Enables a feature flag for a specific target in the current environment. Currently, supported targets include users and organizations.
feature_flags.targets.delete	Removes a target from the feature flag's target list in the current environment. Currently, supported targets include users and organizations.
organization_domains.create	Creates a new Organization Domain.
organization_domains.get	Get the details of an existing organization domain.
organization_domains.delete	Permanently deletes an organization domain. It cannot be undone.
organization_domains.verify	Initiates verification process for an Organization Domain.
organizations.list	Get a list of all of your existing organizations matching the criteria specified.
organizations.create	Creates a new organization in the current environment.
organizations.external_id.get	Get the details of an existing organization by an [external identifier](/authkit/metadata/external-identifiers).
organizations.get	Get the details of an existing organization.
organizations.update	Updates an organization in the current environment.
organizations.delete	Permanently deletes an organization in the current environment. It cannot be undone.
organizations.audit_log_configuration.get	Get the unified view of audit log trail and stream configuration for an organization.
organizations.audit_logs_retention.get	Get the configured event retention period for the given Organization.
organizations.audit_logs_retention.update	Set the event retention period for the given Organization.
organizations.api_keys.list	Get a list of all API keys for an organization.
organizations.api_keys.create	Create a new API key for an organization.
organizations.feature_flags.list	Get a list of all enabled feature flags for an organization.
portal.generate_link.create	Generate a Portal Link scoped to an Organization.
radar.attempts.create	Assess a request for risk using the Radar engine and receive a verdict.
radar.attempts.update	You may optionally inform Radar that an authentication attempt or challenge was successful using this endpoint. Some Radar controls depend on tracking recent successful attempts, such as impossible travel.
radar.lists.create	Add an entry to a Radar list.
radar.lists.delete	Remove an entry from a Radar list.
sso.profile.list	Exchange an access token for a user's [Profile](/reference/sso/profile). Because this profile is returned in the [Get a Profile and Token endpoint](/reference/sso/profile/get-profile-and-token) your application usually does not need to call this endpoint. It is available for any authentication flows that require an additional endpoint to retrieve a user's profile.
user_management.email_verification.get	Get the details of an existing email verification code that can be used to send an email to a user for verification.
user_management.invitations.list	Get a list of all of invitations matching the criteria specified.
user_management.invitations.create	Sends an invitation email to the recipient.
user_management.invitations.by_token.get	Retrieve an existing invitation using the token.
user_management.invitations.get	Get the details of an existing invitation.
user_management.invitations.accept.create	Accepts an invitation and, if linked to an organization, activates the user's membership in that organization.
user_management.invitations.resend.create	Resends an invitation email to the recipient. The invitation must be in a pending state.
user_management.invitations.revoke	Revokes an existing invitation.
user_management.organization_memberships.list	Get a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships are returned. Use the `statuses` parameter to filter by other statuses.
user_management.organization_memberships.create	Creates a new `active` organization membership for the given organization and user. Calling this API with an organization and user that match an `inactive` organization membership will activate the membership with the specified role(s).
user_management.organization_memberships.get	Get the details of an existing organization membership.
user_management.organization_memberships.update	Update the details of an existing organization membership.
user_management.organization_memberships.delete	Permanently deletes an existing organization membership. It cannot be undone.
user_management.organization_memberships.deactivate.update	Deactivates an `active` organization membership. Emits an [organization_membership.updated](/events/organization-membership) event upon successful deactivation. - Deactivating an `inactive` membership is a no-op and does not emit an event. - Deactivating a `pending` membership returns an error. This membership should be [deleted](/reference/authkit/organization-membership/delete) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.
user_management.organization_memberships.reactivate.update	Reactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](/events/organization-membership) event upon successful reactivation. - Reactivating an `active` membership is a no-op and does not emit an event. - Reactivating a `pending` membership returns an error. The user needs to [accept the invitation](/authkit/invitations) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.
user_management.users.list	Get a list of all of your existing users matching the criteria specified.
user_management.users.create	Create a new user in the current environment.
user_management.users.external_id.get	Get the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers).
user_management.users.get	Get the details of an existing user.
user_management.users.update	Updates properties of a user. The omitted properties will be left unchanged.
user_management.users.delete	Permanently deletes a user in the current environment. It cannot be undone.
user_management.users.email_change.confirm.create	Confirms an email change using the one-time code received by the user.
user_management.users.email_change.send	Sends an email that contains a one-time code used to change a user's email address.
user_management.users.email_verification.confirm.create	Verifies an email address using the one-time code received by the user.
user_management.users.email_verification.send	Sends an email that contains a one-time code used to verify a user’s email address.
user_management.users.identities.list	Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.
user_management.users.sessions.list	Get a list of all active sessions for a specific user.
user_management.users.feature_flags.list	Get a list of all enabled feature flags for the provided user. This includes feature flags enabled specifically for the user as well as any organizations that the user is a member of.
user_management.users.authorized_applications.list	Get a list of all Connect applications that the user has authorized.
user_management.users.authorized_applications.delete	Delete an existing Authorized Connect Application.
user_management.users.connected_accounts.get	Retrieves a user's [connected account](/reference/pipes/connected-account) for a specific provider.
user_management.users.connected_accounts.delete	Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.
user_management.users.data_providers.list	Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](/reference/pipes/connected-account) information where applicable.
user_management.users.auth_factors.list	Lists the [authentication factors](/reference/authkit/mfa/authentication-factor) for a user.
user_management.users.auth_factors.create	Enrolls a user in a new [authentication factor](/reference/authkit/mfa/authentication-factor).
webhook_endpoints.list	Get a list of all of your existing webhook endpoints.
webhook_endpoints.create	Create a new webhook endpoint to receive event notifications.
webhook_endpoints.update	Update the properties of an existing webhook endpoint.
webhook_endpoints.delete	Delete an existing webhook endpoint.

WorkOS

接入信息

能力清单

相关资产

social-superpowers

IBANforge

Bling

SystemIntelPilot

CPlug (ConnectPlug)

Hyperliquid Market Data — Orderbooks, Prices, OHLCV