Integration

OneLogin integration

OneLogin is a workforce identity and single sign-on platform. With its API v2 you can list, create, update, unlock, log out and delete users, manage custom user fields, manage roles (their apps, users and administrators) and groups, read apps, app users and connectors, search the event log, and list or remove a user's MFA factors. Writes change who can log in and what people can access. Password setting, app creation and editing, SSO certificates, MFA enrollment and verification, reports and the other admin families (policies, branding, smart hooks, API authorization, user mappings, Vigilance AI) are not exposed. Authentication uses an API credential (client ID and secret) of your OneLogin account, exchanged for an access token on your subdomain.

Connect OneLogin How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in OneLogin.Built from the 44 OneLogin tools below, on the connection you add once.

What you can do with OneLogin

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

User, 9 operations

add_role_usersAdd role usersPOSTAssigns users to a role: they gain access to the role's apps.
create_userCreate userPOSTCreates a user in OneLogin, giving a person an identity that can log in once active. Pass a username and an email. No invite email is sent, and setting a password is not exposed.
delete_userDelete userDELETEPermanently deletes a user: the person can no longer log in to OneLogin. This cannot be undone.
get_userGet userGETReturns one user's profile, status, roles, group, directory details, login dates and custom attribute values. Returns personal data.
list_app_usersList app usersGETReturns a page of the users assigned to an app, with their ID, names, username and email. Returns personal data.
list_role_usersList role usersGETReturns a page of the users assigned to a role, with who added each one and when. Returns personal data (names, usernames).
list_usersList usersGETReturns a page of users in the account, filtered by name, email, username, directory, app, IDs or creation, update and login dates. Returns personal data (names, emails, phone numbers).
remove_role_usersRemove role usersDELETERemoves users from a role: they lose access to the apps it granted.
update_userUpdate userPUTUpdates the fields you pass on a user. Changing status, state, roles or group changes whether and how the person can log in and what they can access. Setting a password is not exposed.

App, 5 operations

get_appGet appGETReturns an app's settings: connector, type, visibility, policy, roles, provisioning flag, SSO URLs or client ID and type-specific configuration. Certificates, secrets and parameters are not returned.
list_appsList appsGETReturns a page of the apps in the account, filtered by name, connector or type, with their type, visibility and dates.
list_role_appsList role appsGETReturns a page of the apps assigned to a role, with each app's ID, name and icon URL.
list_user_appsList user appsGETLists the apps assigned to a user, with the per-user login ID and provisioning status of each.
set_role_appsSet role appsPUTReplaces the apps assigned to a role with the complete list given: apps left out are removed, and the role's users gain or lose access to them.

Custom attribute, 5 operations

create_custom_attributeCreate custom attributePOSTCreates a custom user field in the account. Its short name must be unique and is the key users carry it under in custom_attributes.
delete_custom_attributeDelete custom attributeDELETEPermanently deletes a custom user field and the value every user holds in it. This cannot be undone.
get_custom_attributeGet custom attributeGETReturns one custom user field: its ID, display name, short name and position.
list_custom_attributesList custom attributesGETLists the custom user fields defined in the account, with the ID, display name, short name and position of each.
update_custom_attributeUpdate custom attributePUTRenames a custom user field or changes its short name; both name and shortname are required.

Group, 5 operations

create_groupCreate groupPOSTCreates a group, optionally with a security policy. Members are set on each user (group_id of update_user), not here.
delete_groupDelete groupDELETEDeletes a group. Its users are not deleted, but no longer get the group's security policy. This cannot be undone.
get_groupGet groupGETReturns a group with its security policy, administrators and member users (IDs, emails and names). Returns personal data.
list_groupsList groupsGETReturns a page of groups (used to apply a security policy to a set of users), each with its policy ID and user count.
update_groupUpdate groupPUTUpdates a group's name, security policy or reference. Changing the policy changes the login rules of every member.

Role, 5 operations

create_roleCreate rolePOSTCreates a role, optionally assigning apps, users and role administrators at once: the users gain access to those apps.
delete_roleDelete roleDELETEDeletes a role: its users lose the app access it granted. This cannot be undone.
get_roleGet roleGETReturns a role's ID and name. Its users, apps and admins come from list_role_users, list_role_apps and list_role_admins.
list_rolesList rolesGETReturns a page of roles, filtered by name or by an app they contain, optionally with the IDs of their apps, users and admins.
update_roleUpdate rolePUTRenames a role.

Admin, 3 operations

add_role_adminsAdd role adminsPOSTMakes users administrators of a role, so they can manage its users and apps.
list_role_adminsList role adminsGETReturns a page of the administrators of a role, with who added each one and when. Returns personal data (names, usernames).
remove_role_adminsRemove role adminsDELETERemoves users from the administrators of a role.

Device, 2 operations

list_enrolled_mfa_factorsList enrolled mfa factorsGETLists the MFA devices a user has enrolled and that can be verified through the API, with which one is the default.
remove_mfa_factorRemove mfa factorDELETERemoves an enrolled MFA device from a user, who can then no longer use it as a second factor to log in.

Event, 2 operations

get_eventGet eventGETReturns one event: who acted on whom, the app, role, group or policy involved, IP addresses, notes and risk score. Returns personal data.
list_eventsList eventsGETReturns account events (logins, user and role changes, provisioning...) newest first, up to 100 per page, filtered by type, user, app, role, group, dates, IP, risk score or text. Returns personal data.

Authentication factor, 1 operation

list_authentication_factorsList authentication factorsGETLists the MFA factor types configured on the account (such as SMS or Google Authenticator), not a user's own factors.

Bulk logout, 1 operation

bulk_logout_usersBulk logout usersPOSTEnds the sessions of many users at once, so they must log in again: everyone (all true), or the users matching role_id, group_id and status combined. Accounts are not disabled.

Connector, 1 operation

list_connectorsList connectorsGETReturns a page of the connectors (app templates) apps can be created from, with their type and whether they accept custom parameters.

Delegated privilege, 1 operation

list_user_delegated_privilegesList user delegated privilegesGETLists the delegated administration privileges granted to a user, each with its ID, name and description.

Factor, 1 operation

list_available_mfa_factorsList available mfa factorsGETLists the MFA factors a user can still enroll through the API, per their policy; factors already enrolled are not returned.

Privilege, 1 operation

list_user_privilegesList user privilegesGETLists the administrative privileges granted to a user, each with its ID and name (such as Super user or Manage accounts).

Type, 1 operation

list_event_typesList event typesGETReturns every OneLogin event type with its ID (the event_type_id of events and of the list_events filter), name and description template. The list changes rarely.

Unlock, 1 operation

unlock_userUnlock userPOSTUnlocks a locked user so the person can log in again, and returns a message saying whether it worked.

Use OneLogin from Claude Code, Cursor or Codex

Connect OneLogin in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its OneLogin operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect OneLogin

Create your workspace
Sign up free. Nothing to install.
Connect OneLogin once
Add your OneLogin connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.