> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Workflows

> Use Cloudflare Access workflow actions in Ravenna to grant, revoke, and audit access to Cloudflare Zero Trust applications and groups.

Use Cloudflare Access actions in <Tooltip headline="Workflows" tip="Automated actions triggered by ticket events or manual triggers" cta="Learn about workflows" href="/documentation/automate/workflows/overview">workflows</Tooltip> to grant and revoke access to Cloudflare Zero Trust applications, check membership, and look up applications and groups.

<Callout icon="link" color="#6B7280">
  See the [Cloudflare Access setup guide](/integrations/cloudflare-access/setup) to connect your organization.
</Callout>

## Actions

<AccordionGroup>
  <Accordion title="Add User to Group">
    Adds one or more users to a Cloudflare Access group. Users must exist in Cloudflare Access; add them to the group by matching on email address.

    **Input fields:**

    * `Users`: One or more Ravenna users to add (supports user groups)
    * `Group`: The Cloudflare Access group to add the users to

    **Output data:**

    * `Added Users`: Users that were added successfully
    * `Failed Users`: Users that could not be added
    * `Total Added`: Count of users added

    **Common use cases:**

    * Grant access to a Cloudflare-protected application after an access request is approved
    * Provision Cloudflare Access groups during onboarding
    * Add contractors to time-bound Cloudflare Access groups
  </Accordion>

  <Accordion title="Remove User from Group">
    Removes one or more users from a Cloudflare Access group.

    **Input fields:**

    * `Users`: One or more Ravenna users to remove (supports user groups)
    * `Group`: The Cloudflare Access group to remove the users from

    **Output data:**

    * `Removed Users`: Users that were removed successfully
    * `Failed Users`: Users that could not be removed
    * `Total Removed`: Count of users removed

    **Common use cases:**

    * Revoke access to Cloudflare-protected applications during offboarding
    * Remove contractors from access groups when an engagement ends
    * Clean up group membership after role changes
  </Accordion>

  <Accordion title="Check Group Membership">
    Checks whether a user is a member of a Cloudflare Access group. Use this to gate downstream workflow steps on current access.

    **Input fields:**

    * `User Email`: The email address to check
    * `Group ID`: The Cloudflare Access group to check membership against

    **Output data:**

    * `Is Member`: Whether the user is a member of the group

    **Common use cases:**

    * Verify a user already has access before running further provisioning
    * Branch a workflow based on current Cloudflare Access group membership
    * Audit access as part of a periodic access review
  </Accordion>

  <Accordion title="Check User Exists">
    Checks whether a user exists in Cloudflare Access by email.

    **Input fields:**

    * `User Email`: The email address to look up

    **Output data:**

    * `Is Cloudflare User`: Whether the user was found in Cloudflare Access

    **Common use cases:**

    * Confirm a requester has signed in to Cloudflare Access before granting group access
    * Branch a workflow based on whether the user is known to Cloudflare
    * Skip Cloudflare-specific steps for users who have never authenticated
  </Accordion>

  <Accordion title="List Groups">
    Lists Cloudflare Access groups for use in downstream workflow actions. Groups can be filtered so only relevant results are returned.

    **Output data:**

    * `Groups`: Cloudflare Access group IDs, ready to pass to other actions

    **Common use cases:**

    * Iterate over groups during offboarding to remove a user from each one
    * Build a list of candidate groups for an approval step
    * Feed groups into a downstream workflow that operates on many groups at once
  </Accordion>

  <Accordion title="Get Group">
    Retrieves details and members for a single Cloudflare Access group.

    **Input fields:**

    * `Group`: The Cloudflare Access group to look up

    **Output data:**

    * `Users`: Member email addresses
    * `Group`: Group name and metadata

    **Common use cases:**

    * Show approvers who currently has access before they approve a request
    * Capture a group's membership before a bulk change so it can be reviewed
    * Populate a ticket comment with the current member list
  </Accordion>

  <Accordion title="List Applications">
    Lists Cloudflare Access applications for use in downstream workflow actions or approval steps.

    **Output data:**

    * `Applications`: Cloudflare Access applications

    **Common use cases:**

    * Present a picker of Cloudflare-protected applications in an access request form
    * Iterate over applications during an access review
    * Feed applications into downstream reporting or auditing workflows
  </Accordion>

  <Accordion title="Get Application">
    Retrieves details for a single Cloudflare Access application.

    **Input fields:**

    * `Application`: The Cloudflare Access application to look up

    **Output data:**

    * `Application`: Application name, ID, and metadata

    **Common use cases:**

    * Include application details in an approval notification
    * Look up the underlying application before adjusting group access
    * Confirm the application still exists in Cloudflare before running provisioning steps
  </Accordion>
</AccordionGroup>


## Related topics

- [Workflows](/documentation/automate/workflows/overview.md)