@spec accept_invitation(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.Invitation.t()} | {:error, WorkOS.Error.error()}

Accept an invitation

Accepts an invitation and, if linked to an organization, activates the user's membership in that organization.

Parameters

• id — The unique ID of the invitation.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_code(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with code

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("authorization_code") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :code. Optional: :code_verifier, :invitation_token, :ip_address, :device_id, :user_agent, :signals_id.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_device_code(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with device code

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:ietf:params:oauth:grant-type:device_code") automatically.

Reads client_id from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :device_code. Optional: :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_email_verification(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with email verification

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:workos:oauth:grant-type:email-verification:code") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :code, :pending_authentication_token. Optional: :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_magic_auth(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with magic auth

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:workos:oauth:grant-type:magic-auth:code") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :code, :email. Optional: :invitation_token, :ip_address, :device_id, :user_agent, :radar_auth_attempt_id.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_organization_selection(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with organization selection

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:workos:oauth:grant-type:organization-selection") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :pending_authentication_token, :organization_id. Optional: :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_password(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with password

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("password") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :email, :password. Optional: :invitation_token, :ip_address, :device_id, :user_agent, :signals_id, :radar_auth_attempt_id.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_radar_email_challenge(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with radar email challenge

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:workos:oauth:grant-type:radar-email-challenge:code") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :code, :radar_challenge_id, :pending_authentication_token. Optional: :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_radar_sms_challenge(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with radar sms challenge

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:workos:oauth:grant-type:radar-sms-challenge:code") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :code, :verification_id, :phone_number, :pending_authentication_token. Optional: :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_refresh_token(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with refresh token

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("refresh_token") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :refresh_token. Optional: :organization_id, :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec authenticate_with_totp(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.AuthenticateResponse.t()} | {:error, WorkOS.Error.error()}

Authenticate with totp

Authenticate

Authenticate a user with a specified authentication method.

Sets grant_type ("urn:workos:oauth:grant-type:mfa-totp") automatically.

Reads client_id/client_secret from the client configuration unless passed explicitly.

Parameters

• params — request body map. Required: :code, :pending_authentication_token, :authentication_challenge_id. Optional: :ip_address, :device_id, :user_agent.
• opts — per-request options (see WorkOS.Client.request/5)

@spec confirm_email_change(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.EmailChangeConfirmation.t()} | {:error, WorkOS.Error.error()}

Confirm email change

Confirms an email change using the one-time code received by the user.

Parameters

• id — The unique ID of the user.
• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec confirm_password_reset(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.ResetPasswordResponse.t()} | {:error, WorkOS.Error.error()}

Reset the password

Sets a new password using the token query parameter from the link that the user received. Successfully resetting the password will verify a user's email, if it hasn't been verified yet.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_cors_origin(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.CORSOriginResponse.t()} | {:error, WorkOS.Error.error()}

Create a CORS origin

Creates a new CORS origin for the API key's application. CORS origins allow browser-based applications to make requests to the WorkOS API.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_device(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.DeviceAuthorizationResponse.t()} | {:error, WorkOS.Error.error()}

Get device authorization URL

Initiates the CLI Auth flow by requesting a device code and verification URLs. This endpoint implements the OAuth 2.0 Device Authorization Flow (RFC 8628) and is designed for command-line applications or other devices with limited input capabilities.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_magic_auth(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.MagicAuthSendMagicAuthCodeAndReturnResponse.t()}
  | {:error, WorkOS.Error.error()}

Create a Magic Auth code

Creates a one-time authentication code that can be sent to the user's email address. The code expires in 10 minutes. To verify the code, authenticate the user with Magic Auth.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_radar_challenge(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.SendRadarSmsChallengeResponse.t()}
  | {:error, WorkOS.Error.error()}

Send a Radar SMS challenge

Sends a one-time verification code over SMS to a user as part of a Radar challenge. Use the returned verification_id to authenticate the user with the urn:workos:oauth:grant-type:radar-sms-challenge:code grant type.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_redirect_uri(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.RedirectUri.t()} | {:error, WorkOS.Error.error()}

Create a redirect URI

Creates a new redirect URI for an application.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_user(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.UserCreateResponse.t()} | {:error, WorkOS.Error.error()}

Create a user

Create a new user in the current environment.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec create_user_api_key(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.UserApiKeyWithValue.t()} | {:error, WorkOS.Error.error()}

Create an API key for a user

Create a new API key owned by a user. The user must have an active membership in the specified organization.

Parameters

• user_id — Unique identifier of the user.
• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec delete_redirect_uris(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, term()} | {:error, WorkOS.Error.error()}

Delete a redirect URI

Deletes a redirect URI from an application.

Parameters

• id — The ID of the redirect URI to delete.
• opts — per-request options (see WorkOS.Client.request/5)

@spec delete_user(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, term()} | {:error, WorkOS.Error.error()}

Delete a user

Permanently deletes a user in the current environment. It cannot be undone.

Parameters

• id — The unique ID of the user.
• opts — per-request options (see WorkOS.Client.request/5)

@spec delete_user_authorized_application(
  WorkOS.Client.t(),
  String.t(),
  String.t(),
  keyword()
) ::
  {:ok, term()} | {:error, WorkOS.Error.error()}

Delete an authorized application

Delete an existing Authorized Connect Application.

Parameters

• user_id — The ID of the user.
• application_id — The ID or client ID of the application.
• opts — per-request options (see WorkOS.Client.request/5)

@spec find_invitation_by_token(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.UserInvite.t()} | {:error, WorkOS.Error.error()}

Find an invitation by token

Retrieve an existing invitation using the token.

Parameters

• token — The token used to accept the invitation.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_authorization_url(WorkOS.Client.t(), map()) :: String.t()

Get an authorization URL

Generates an OAuth 2.0 authorization URL to authenticate a user with AuthKit or SSO.

Returns the fully-qualified redirect URL — no HTTP request is made.

Sets response_type ("code") automatically.

Reads client_id from the client configuration unless passed explicitly.

Parameters

• params — query parameters: :code_challenge_method, :code_challenge, :domain_hint, :connection_id, :provider_query_params, :provider_scopes, :invitation_token, :max_age, :screen_hint, :login_hint, :provider, :prompt, :state, :organization_id, :redirect_uri

@spec get_email_verification(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.EmailVerification.t()} | {:error, WorkOS.Error.error()}

Get an email verification code

Get the details of an existing email verification code that can be used to send an email to a user for verification.

Parameters

• id — The ID of the email verification code.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_invitation(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.UserInvite.t()} | {:error, WorkOS.Error.error()}

Get an invitation

Get the details of an existing invitation.

Parameters

• id — The unique ID of the invitation.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_jwks(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.JwksResponse.t()} | {:error, WorkOS.Error.error()}

Get JWKS

Returns the JSON Web Key Set (JWKS) containing the public keys used for verifying access tokens.

Parameters

• client_id — Identifies the application making the request to the WorkOS server. You can obtain your client ID from the API Keys page in the dashboard.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_logout_url(WorkOS.Client.t(), map()) :: String.t()

Logout

Logout a user from the current session.

Returns the fully-qualified redirect URL — no HTTP request is made.

Parameters

• params — query parameters: :session_id, :return_to

@spec get_magic_auth(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.MagicAuth.t()} | {:error, WorkOS.Error.error()}

Get Magic Auth code details

Get the details of an existing Magic Auth code that can be used to send an email to a user for authentication.

Parameters

• id — The unique ID of the Magic Auth code.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_password_reset(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.PasswordReset.t()} | {:error, WorkOS.Error.error()}

Get a password reset token

Get the details of an existing password reset token that can be used to reset a user's password.

Parameters

• id — The ID of the password reset token.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_radar_challenge(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.RadarChallenge.t()} | {:error, WorkOS.Error.error()}

Get Radar Challenge details

Get the details of an existing Radar Challenge, including the OTP code.

Parameters

• id — The unique ID of the Radar Challenge.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_user(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.User.t()} | {:error, WorkOS.Error.error()}

Get a user

Get the details of an existing user.

Parameters

• id — The unique ID of the user.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_user_by_external_id(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.User.t()} | {:error, WorkOS.Error.error()}

Get a user by external ID

Get the details of an existing user by an external identifier.

Parameters

• external_id — The external ID of the user.
• opts — per-request options (see WorkOS.Client.request/5)

@spec get_user_identities(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, [WorkOS.UserIdentitiesGetItem.t()]} | {:error, WorkOS.Error.error()}

Get user identities

Get a list of identities associated with the user. A user can have multiple associated identities after going through identity linking. Currently only OAuth identities are supported. More provider types may be added in the future.

Parameters

• id — The unique ID of the user.
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_cors_origins(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.Page.t(WorkOS.CORSOriginResponse.t())}
  | {:error, WorkOS.Error.error()}

List CORS origins

Lists the CORS origins for the current environment.

Parameters

• params — query parameters: :before, :after_, :limit, :order
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_invitations(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.Page.t(WorkOS.UserInvite.t())} | {:error, WorkOS.Error.error()}

List invitations

Get a list of all of invitations matching the criteria specified.

Parameters

• params — query parameters: :before, :after_, :limit, :order, :organization_id, :email
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_jwt_template(
  WorkOS.Client.t(),
  keyword()
) :: {:ok, WorkOS.JWTTemplateResponse.t()} | {:error, WorkOS.Error.error()}

Get JWT template

Get the JWT template for the current environment.

Parameters

• opts — per-request options (see WorkOS.Client.request/5)

@spec list_redirect_uris(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.Page.t(WorkOS.RedirectUri.t())} | {:error, WorkOS.Error.error()}

List redirect URIs

Lists the redirect URIs for an environment.

Parameters

• params — query parameters: :before, :after_, :limit, :order
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_sessions(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.Page.t(WorkOS.UserSessionsListItem.t())}
  | {:error, WorkOS.Error.error()}

List sessions

Get a list of all active sessions for a specific user.

Parameters

• id — The ID of the user.
• params — query parameters: :before, :after_, :limit, :order
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_user_api_keys(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.Page.t(WorkOS.UserApiKey.t())} | {:error, WorkOS.Error.error()}

List API keys for a user

Get a list of API keys owned by a specific user.

Parameters

• user_id — Unique identifier of the user.
• params — query parameters: :before, :after_, :limit, :order, :organization_id
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_user_authorized_applications(
  WorkOS.Client.t(),
  String.t(),
  map(),
  keyword()
) ::
  {:ok, WorkOS.Page.t(WorkOS.AuthorizedConnectApplicationListData.t())}
  | {:error, WorkOS.Error.error()}

List authorized applications

Get a list of all Connect applications that the user has authorized.

Parameters

• user_id — The ID of the user.
• params — query parameters: :before, :after_, :limit, :order
• opts — per-request options (see WorkOS.Client.request/5)

@spec list_users(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.Page.t(WorkOS.User.t())} | {:error, WorkOS.Error.error()}

List users

Get a list of all of your existing users matching the criteria specified.

Parameters

• params — query parameters: :before, :after_, :limit, :order, :organization (deprecated), :organization_id, :email
• opts — per-request options (see WorkOS.Client.request/5)

@spec resend_invitation(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.UserInvite.t()} | {:error, WorkOS.Error.error()}

Resend an invitation

Resends an invitation email to the recipient. The invitation must be in a pending state.

Parameters

• id — The unique ID of the invitation.
• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec reset_password(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.PasswordReset.t()} | {:error, WorkOS.Error.error()}

Create a password reset token

Creates a one-time token that can be used to reset a user's password.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec revoke_invitation(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.Invitation.t()} | {:error, WorkOS.Error.error()}

Revoke an invitation

Revokes an existing invitation.

Parameters

• id — The unique ID of the invitation.
• opts — per-request options (see WorkOS.Client.request/5)

@spec revoke_session(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, term()} | {:error, WorkOS.Error.error()}

Revoke Session

Revoke a user session.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec send_email_change(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.EmailChange.t()} | {:error, WorkOS.Error.error()}

Send email change code

Sends an email that contains a one-time code used to change a user's email address.

Parameters

• id — The unique ID of the user.
• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec send_invitation(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.UserInvite.t()} | {:error, WorkOS.Error.error()}

Send an invitation

Sends an invitation email to the recipient.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec send_verification_email(WorkOS.Client.t(), String.t(), keyword()) ::
  {:ok, WorkOS.SendVerificationEmailResponse.t()}
  | {:error, WorkOS.Error.error()}

Send verification email

Sends an email that contains a one-time code used to verify a user's email address.

Parameters

• id — The ID of the user.
• opts — per-request options (see WorkOS.Client.request/5)

@spec update_jwt_template(WorkOS.Client.t(), map(), keyword()) ::
  {:ok, WorkOS.JWTTemplateResponse.t()} | {:error, WorkOS.Error.error()}

Update JWT template

Update the JWT template for the current environment.

Parameters

• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec update_user(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.User.t()} | {:error, WorkOS.Error.error()}

Update a user

Updates properties of a user. The omitted properties will be left unchanged.

Parameters

• id — The unique ID of the user.
• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)

@spec verify_email(WorkOS.Client.t(), String.t(), map(), keyword()) ::
  {:ok, WorkOS.VerifyEmailResponse.t()} | {:error, WorkOS.Error.error()}

Verify email

Verifies an email address using the one-time code received by the user.

Parameters

• id — The ID of the user.
• params — request body map
• opts — per-request options (see WorkOS.Client.request/5)