Identity nodes

Identity nodes let a workflow authorize an app user and perform supported identity operations. Put authorization before business reads or writes and use its result as the trusted user identity.

IdP Authorize#

Add IdP Authorize as the action's entry node and connect it to the previous first business node. It validates the bearer token supplied in Authorization.

Choose the output your workflow needs:

If the node is named IdpAuth and returns a user ID, downstream nodes use ${IdpAuth}. Do not substitute a caller's query or body userId for this result.

Missing or invalid authentication returns 401 unless anonymous access is explicitly enabled. Optional role and permission gates can return 403 for authenticated users without the required access. Anonymous access is a separate setting; do not enable it to bypass a failed authentication test.

IdP Users: list or update#

The node supports user lookup/list operations and an Update user operation. For an update, choose an exact lookup field: ID, email, phone number, or identity number. Supply a lookup value and a JSON object containing supported changes.

{
  "name": "Avery",
  "surname": "Example"
}

The lookup must identify exactly one eligible account in the current tenant. Omitted or null fields stay unchanged. The output is a safe user object; it does not contain passwords or hashes.

This is a privileged server operation. Authorize the caller before reaching it. Password or identity migration also requires a trusted authentication step; knowing an email address does not prove account ownership.

Sandbox and production share tenant app-user records. Use fixture accounts for update tests.

Some deployments expose additional authentication-state operations. Use the operation-specific editor and supported contract; do not infer their inputs from the list/update examples.

See identity setup and users and roles.