The MCP tool directory.

Sends an invitation email to the recipient.

Get the details of an existing invitation.

Get a list of all of invitations matching the criteria specified.

Resends an invitation email to the recipient. The invitation must be in a pending state.

Revokes an existing invitation.

Creates a new `active` organization membership for the given organization and user. Calling this API with an organization and user that match an `inactive` organization membership will activate the membership with the specified role(s).

Deactivates an `active` organization membership. Emits an [organization_membership.updated](/events/organization-membership) event upon successful deactivation. - Deactivating an `inactive` membership is a no-op and does not emit an event. - Deactivating a `pending` membership returns an error. This membership should be [deleted](/reference/authkit/organization-membership/delete) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.

Permanently deletes an existing organization membership. It cannot be undone.

Get the details of an existing organization membership.

Get a list of all organization memberships matching the criteria specified. At least one of `user_id` or `organization_id` must be provided. By default only active memberships are returned. Use the `statuses` parameter to filter by other statuses.

Reactivates an `inactive` organization membership, retaining the pre-existing role(s). Emits an [organization_membership.updated](/events/organization-membership) event upon successful reactivation. - Reactivating an `active` membership is a no-op and does not emit an event. - Reactivating a `pending` membership returns an error. The user needs to [accept the invitation](/authkit/invitations) instead. See the [membership management documentation](/authkit/users-organizations/organizations/membership-management) for additional details.

Update the details of an existing organization membership.

Enrolls a user in a new [authentication factor](/reference/authkit/mfa/authentication-factor).

Lists the [authentication factors](/reference/authkit/mfa/authentication-factor) for a user.

Delete an existing Authorized Connect Application.

Get a list of all Connect applications that the user has authorized.

Disconnects WorkOS's account for the user, including removing any stored access and refresh tokens. The user will need to reauthorize if they want to reconnect. This does not revoke access on the provider side.

Retrieves a user's [connected account](/reference/pipes/connected-account) for a specific provider.

Create a new user in the current environment.

Retrieves a list of available providers and the user's connection status for each. Returns all providers configured for your environment, along with the user's [connected account](/reference/pipes/connected-account) information where applicable.

Permanently deletes a user in the current environment. It cannot be undone.

Confirms an email change using the one-time code received by the user.

Sends an email that contains a one-time code used to change a user's email address.

Verifies an email address using the one-time code received by the user.

Sends an email that contains a one-time code used to verify a user’s email address.

Get the details of an existing user by an [external identifier](/authkit/metadata/external-identifiers).

Get a list of all enabled feature flags for the provided user. This includes feature flags enabled specifically for the user as well as any organizations that the user is a member of.

Get the details of an existing user.

Get a list of identities associated with the user. A user can have multiple associated identities after going through [identity linking](/authkit/identity-linking). Currently only OAuth identities are supported. More provider types may be added in the future.

Get a list of all of your existing users matching the criteria specified.