> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Workflows

> Use OneLogin workflow actions in Ravenna to activate users, manage groups and roles, reset passwords, and automate user lifecycle from tickets.

Use OneLogin actions in <Tooltip headline="Workflows" tip="Automated actions triggered by ticket events or manual triggers" cta="Learn about workflows" href="/documentation/automate/workflows/overview">workflows</Tooltip> to automate user lifecycle management, group and role assignments, and password resets.

<Callout icon="link" color="#6B7280">
  See [OneLogin setup guide](/integrations/onelogin/setup) to connect your organization
</Callout>

## Actions

<AccordionGroup>
  <Accordion title="Activate User">
    Activates one or more suspended or unapproved users in OneLogin, restoring their access. Use this when employees return from leave or when accounts need to be reactivated.

    **Input fields:**

    * `User IDs` - One or more Ravenna user IDs to activate (supports user groups)

    **Common use cases:**

    * Reactivate accounts when employees return from leave
    * Restore access after a security review clears an account
    * Re-enable contractor accounts for new engagements
    * Implement automated account reactivation workflows
  </Accordion>

  <Accordion title="Suspend User">
    Suspends one or more active users in OneLogin, disabling their access without permanently deleting the account. Use this for temporary access suspension or as part of offboarding workflows.

    **Input fields:**

    * `User IDs` - One or more Ravenna user IDs to suspend (supports user groups)

    **Common use cases:**

    * Suspend access during employee offboarding
    * Temporarily disable accounts for employees on extended leave
    * Respond to security incidents by quickly disabling compromised accounts
    * Implement automated account suspension policies
  </Accordion>

  <Accordion title="Add User to Group">
    Adds one or more users to a OneLogin group. OneLogin users can only belong to one primary group at a time, so adding a user to a new group replaces their existing group assignment.

    **Input fields:**

    * `User IDs` - One or more Ravenna user IDs to add (supports user groups)
    * `Group` - The OneLogin group to add the users to

    **Common use cases:**

    * Automate onboarding group assignments
    * Grant team access after approval
    * Reassign users between departments
    * Update group memberships based on role changes
  </Accordion>

  <Accordion title="Remove User from Group">
    Removes one or more users from a OneLogin group. Use this to revoke access, handle offboarding, or update group memberships.

    **Input fields:**

    * `User IDs` - One or more Ravenna user IDs to remove (supports user groups)
    * `Group` - The OneLogin group to remove the users from

    **Common use cases:**

    * Revoke access during offboarding
    * Update group memberships after role changes
    * Remove temporary access after a project ends
    * Clean up stale group assignments
  </Accordion>

  <Accordion title="Add User to Role">
    Assigns one or more users to a OneLogin role. Unlike groups, users can belong to multiple roles simultaneously. Synced roles appear with a "Role: " prefix in Ravenna.

    **Input fields:**

    * `User IDs` - One or more Ravenna user IDs to add (supports user groups)
    * `Role` - The OneLogin role to assign

    **Common use cases:**

    * Automate onboarding role assignments
    * Grant application access through role-based provisioning
    * Elevate permissions for temporary project needs
    * Implement role-based access control workflows
  </Accordion>

  <Accordion title="Remove User from Role">
    Removes one or more users from a OneLogin role. Use this to revoke role-based access or update assignments.

    **Input fields:**

    * `User IDs` - One or more Ravenna user IDs to remove (supports user groups)
    * `Role` - The OneLogin role to remove the users from

    **Common use cases:**

    * Revoke role-based access during offboarding
    * Remove elevated permissions after project completion
    * Update role assignments after organizational changes
    * Implement automated role lifecycle policies
  </Accordion>

  <Accordion title="Get User by Email">
    Looks up a OneLogin user by email address and returns whether the user exists along with their Ravenna user ID. Use this to verify user existence before performing other actions or to find users dynamically in workflows.

    **Input fields:**

    * `Email` - Email address to search for in OneLogin

    **Output data:**

    * `userId` - The Ravenna user ID if the user was found
    * `email` - The confirmed email address
    * `found` - Boolean indicating if the user was found

    **Common use cases:**

    * Verify a user exists before provisioning access
    * Look up users dynamically in conditional workflows
    * Check if accounts already exist before creating new ones
    * Find users by email for downstream workflow actions
  </Accordion>

  <Accordion title="Check Group Membership">
    Checks if a user is a member of a specific OneLogin group. Use this to validate access, make conditional workflow decisions, or verify group memberships before granting permissions.

    **Input fields:**

    * `User ID` - Ravenna user ID to check
    * `Group` - The OneLogin group to check membership against

    **Output data:**

    * `isMember` - Boolean indicating if the user is a member of the group

    **Common use cases:**

    * Validate access before performing actions
    * Make conditional workflow decisions based on group membership
    * Verify group prerequisites before granting additional permissions
    * Audit group memberships during access reviews
  </Accordion>

  <Accordion title="Generate Password Reset Token">
    Generates a password reset URL for a OneLogin user. Use this to provide direct reset links or integrate with custom notification workflows.

    **Input fields:**

    * `User ID` - Ravenna user ID to generate the reset token for

    **Output data:**

    * `resetUrl` - Password reset URL to send to the user

    **Common use cases:**

    * Provide direct reset links in self-service workflows
    * Include reset URLs in onboarding notifications
    * Handle programmatic password resets
    * Integrate with custom notification channels
  </Accordion>

  <Accordion title="Set User Password">
    Directly sets a password for a OneLogin user without requiring the user to change it on next login. Use **Generate Password Reset Token** when you want the user to choose their own password instead.

    **Input fields:**

    * `User ID` - Ravenna user ID to set the password for
    * `Password` - The new password to set

    **Common use cases:**

    * Set initial account passwords during provisioning
    * Provision temporary passwords for emergency access
    * Automate password management in onboarding workflows
    * Handle emergency account recovery
  </Accordion>
</AccordionGroup>