Checking provisioning
Dan Fletcher, solutions engineer at Acme Ltd, asked whether BigCo's Okta directory had provisioned its new starters. Memtro listed the directory's users with their state and role, and showed two still inactive.
WorkOS + Memtro
Who is in this organisation, and which directory provisioned them?
WorkOS connects Memtro to one environment. It reads AuthKit users with name, email, whether verified and last sign-in, a user's sessions and organisation memberships with roles and status, organisations with their domains, invitations and their state, and Directory Sync directories with their provisioned users. When asked, and once an administrator has granted the action by name, it can delete a user, revoke a session, add, re-role, deactivate, reactivate or delete a membership, send, resend or revoke an invitation, and create an organisation. Each environment needs its own connection, and invitation links are never returned.
In Memtro
What you can do with WorkOS in Memtro
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right WorkOS tool, reads what it needs, and answers with the source cited.
What it does
- 01Lists AuthKit users with name, email, whether verified, external id, last sign-in and created date, filtered by email or organisation
- 02Reads one user with every organisation membership they hold and its role, and their sessions with status and sign-in method
- 03Lists memberships for a user or an organisation with role and status, and organisations with their domains
- 04Lists invitations with state, organisation, role and inviter, and Directory Sync directories with provider type and their provisioned users
- 05When asked and granted, permanently deletes a user, revokes a session, adds a user to an organisation, changes a membership's role, or deactivates, reactivates or deletes a membership
- 06When asked and granted, sends or resends an invitation, which WorkOS emails to the person, revokes a pending invitation, or creates an organisation with a name only
Acts when asked
When you ask it to
These tools change something in WorkOS. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
- 01Delete a user (permanent)
- 02Revoke a user's session
- 03Add a user to an organisation with a role
- 04Change a membership's role
- 05Deactivate an organisation membership (the user loses access)
- 06Reactivate an organisation membership
- 07Delete an organisation membership (permanent)
- 08Send an invitation (WorkOS emails the person)
- 09Resend a pending invitation's email
- 10Revoke a pending invitation
- 11Create an organisation (name only)
Events
When it happens
Turn events on in the connection's Events tab on the Connections page, choose the kinds you want, and Memtro registers its address with WorkOS for you. Each event can start a job, with the event as its input. WorkOS signs every delivery, and one whose signature does not check out is refused before it is read.
Events and webhooks- 01A user was created
- 02A user was updated
- 03A user was deleted
- 04A membership was created
- 05A membership changed role or status
- 06A membership was deleted
- 07An organisation was created
- 08An organisation was updated
- 09An organisation was deleted
- 10A session started
- 11A session was revoked
- 12An invitation was sent
- 13An invitation was accepted
- 14An invitation was revoked
- 15A password sign-in failed
- 16An SSO sign-in failed
- 17Radar flagged a risky sign-in
- 18An SSO connection was activated
- 19An SSO connection was deactivated
- 20A directory was connected
- 21A directory was deleted
- 22A directory user was provisioned
- 23A directory user was updated
- 24A directory user was deprovisioned
- 25A directory user joined a group
In practice
Ask it like you would a colleague
Once WorkOS is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
WorkOS + MemtroWho are the members of the BigCo organisation?
When did priya@acme.com last sign in?
Which invitations are still pending?
Which directories are connected, and from which identity provider?
Deactivate Tom Reilly's membership in the Northwind organisation
Removing access for a leaver
Sarah Chen, customer success manager at Northwind, asked Memtro to remove a leaver's access to the BigCo organisation but keep the membership. Memtro deactivated it in WorkOS, so the user lost access while the membership and roles stayed for reactivation.
Teams
Where it fits
The teams that lean on WorkOS most, a question each of them asks, and what they connect beside it.
- EngineeringKeep decisions from evaporatingEngineer, Tech lead, On call, New joiner“Who owns the billing migration, and what did we decide about retries?”Used alongside GitHub, Linear, Jira, Confluence, Slack and 5 more.
- ProductHear what customers actually ask forProduct manager, Researcher, Designer, Head of product“Which customers asked for SSO this quarter, and what is their combined ARR?”Used alongside Help Scout, HubSpot, Linear, Jira, Slack and 6 more.
- Agent buildersMemory and tools for the agents you buildSolo builder, Platform team, Automation engineer, Whoever signs it off“Search memtro for what we know about Acme before drafting the proposal”Used alongside GitHub, Linear and Slack.
Better together
Works with
A record in WorkOS is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
- Work managementWorkOS with JiraJQL search, issue details and projects from Jira Cloud.
- Work managementWorkOS with Clio ManageAsk the matter: its client, its fee earner, the time on it and what is still unbilled.
- Work managementWorkOS with LinearIssues, projects and teams, synced hourly into memory.
- SupportWorkOS with Help ScoutAI that reads your support conversations and cross-references the customer everywhere else.
- SupportWorkOS with ZendeskEvery ticket, reply and internal note, ready to be asked about.
- SupportWorkOS with IntercomCustomer conversations and the people behind them, in your company memory.
- Documents and wikisWorkOS with NotionSearch pages and query databases, and write to them when you ask.
- Documents and wikisWorkOS with Google DriveSearch Drive and read Docs, Sheets and Slides as text, and write a Doc when you ask.
- Documents and wikisWorkOS with ConfluenceSearch and read wiki pages, and write them when you ask.
Also in Engineering and operations
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
- GitHub
- AWS CloudWatch
- Sentry
- ServiceNow
- Okta
- Twilio
- AWS CloudTrail
- GitLab
- Bitbucket
- Vercel
- PagerDuty
- Datadog
- Grafana
- incident.io
- Azure DevOps
- CircleCI
- Cloudflare
- LaunchDarkly
- New Relic
- Rollbar
- Snyk
- Better Stack
- Buildkite
- DigitalOcean
- Heroku
- Netlify
- SonarQube Cloud
- Statuspage
UptimeRobot- Axiom
- BugSnag
- Checkly
- Hetzner Cloud
Honeycomb- Pingdom
- Render
- Statsig
- Sumo Logic
- Supabase
- HCP Terraform
- Vultr
- Airbrake
- Codecov
Cronitor- Dynatrace
FireHydrant- Fly.io
- Honeybadger
- Akamai Linode
- Octopus Deploy
- Pulumi
- Rootly
- Semgrep
- Splunk
StatusCake- Tailscale
- Argo CD
- authentik
- Coolify
- Gitea
GlitchTip
GLPI- Jenkins
Langfuse
LibreNMS- n8n
NetBox- Portainer
- Prefect
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone- OpenAI (usage and cost)
- Anthropic (usage and cost)
- Algolia
- Flagsmith
- Unleash
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert- KnowBe4
JumpCloud
ConfigCat- Railway
- Fastly
- Postman
- Make
- Braintrust
- OpenRouter
- ElevenLabs
Split- Scaleway
Aikido Security- AssemblyAI
Astronomer- Bamboo
- Baseten
- Bitrise
- Bitwarden
- BrowserStack
- bunny.net
- Cachet
- Checkmk
- Civo
- Cloudsmith
- Codacy
- Codemagic
Comet Opik- Coralogix
CrowdStrike Falcon- Dagster+
- DeepSource
Detectify- Docker Hub
Domotz- Grafana OnCall
- Harness
- Hugging Face
- Instatus
- Koyeb
- Lambda Cloud
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary- Mezmo
NinjaOne- Nomad
Northflank- Oh Dear
- OVHcloud
Portkey- Probely (Snyk API & Web)
PromptLayer- Proxmox VE
PRTG Network Monitor- Qase
Raygun
Retell AI- Retool
Runpod- SecurityScorecard
- Semaphore CI
Shodan- SigNoz
- Socket
Spike.sh
Squadcast- SwaggerHub
- TeamCity
Tenable- Together AI
- Travis CI
UpGuard
Uptime.com
Vanta- Vapi
- Windmill
Zenduty- OpsLevel
Cortex- Auth0
- Clerk
Kandji
Automox
Huntress- HackerOne
SimpleMDM- AppSignal
Healthchecks.io
Rapid7 InsightVM- 1Password Events
- JFrog Artifactory
- Sauce Labs
Zenhub- Deepgram
- Replicate
Setup
How to connect
Connect withAPI key
- 1
In the WorkOS Dashboard, pick the environment, Production or Staging, and open API Keys.
- 2
Copy the secret key, which starts sk_. It has full access to its environment and WorkOS offers no narrower key, so connect it only where an administrator has agreed.
- 3
In Memtro, open Connections → WorkOS and paste it into API key.
- 4
Ask your first question: who are the members of the BigCo organisation?
Also works from
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The WorkOS tools are the same everywhere.
FAQ
Questions
Can Memtro change anything in WorkOS?+
Only when you ask, and only what it has been granted: delete a user (permanent); revoke a user's session; add a user to an organisation with a role; change a membership's role; deactivate an organisation membership (the user loses access); reactivate an organisation membership; delete an organisation membership (permanent); send an invitation (WorkOS emails the person); resend a pending invitation's email; revoke a pending invitation; create an organisation (name only). Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
Who can use a WorkOS connection?+
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Does Memtro store my WorkOS data?+
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
How do I connect WorkOS?+
API key. In the WorkOS Dashboard, pick the environment, Production or Staging, and open API Keys.
Can WorkOS start a job?+
Yes. Turn events on in the connection's Events tab on the Connections page, choose the kinds you want, and Memtro registers its address with WorkOS for you. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.
Connect WorkOS in a few minutes
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.