Onelogin MCP server

Read from the package source without running it. The installed server may list more.

• activate_factor

  Trigger MFA challenge by sending SMS, Voice call, Email, or Push notification. Requires device_id from get_enrolled_factors. Returns verification_id needed for verify_factor. Supports custom_message for SMS, redirect_to for Email MagicLink, and expires_in (120-900 seconds, default 120). Returns verification_id, expires_at, and device info.

• add_authorization_claim

  Add a custom claim to access tokens for an API authorization. Claims enrich tokens with user attributes (email, roles, custom attributes). Required: name (claim key in JWT), user_attribute_mappings (OneLogin user field to map). For custom attributes, prefix with "custom_attribute_" (e.g., "custom_attribute_employee_id"). Optional: user_attribute_macros (when mappings="_macro_"), attributes_transfo

• add_authorization_scopes

  Add OAuth 2.0 scopes to an existing API authorization. The underlying API creates one scope per call; pass multiple {value, description?} objects to add several in one shot. `value` is the scope identifier (e.g., "contact:read") — no whitespace allowed. `description` is a human-readable label. Naming convention: <action>:<resource>. Returns a results array with per-scope ok/error status; on partia

• add_authorized_clients

  Grant OIDC client apps permission to request access tokens for this API authorization. Each client needs an app_id (the OIDC app ID from list_apps or as returned by list_authorized_clients) and a scopes array of numeric API scope IDs (get these from list_authorization_scopes — scope value strings will NOT work here). The underlying API creates one client association per call; pass multiple {app_id

• assign_role_to_privilege

  Assign one or more roles to a privilege, granting the roles' users the privilege's defined actions. IMPORTANT: Requires Delegated Administration subscription. Accepts array of role IDs to assign multiple roles at once. Returns success status and x-request-id (API v1 - Rate Limited).

• assign_users_to_privilege

  Assign one or more users directly to a privilege, granting them the privilege's defined actions. IMPORTANT: Requires Delegated Administration subscription. Accepts array of user IDs to assign multiple users at once. Returns success status and x-request-id (API v1 - Rate Limited).

• create_accountwrite action

  Create a new child account under your reseller account. Requires reseller privileges. The account object should contain name and optionally address1, address2, city, state, zip, country, phone, homepage, notes. Optionally specify plan (subscription plan name), subscription_state, enforce_user_limit, email_activation (true to send activation email to account owner), and api_credential (with name an

• create_api_authorizationwrite action

  Create a new API authorization (OAuth 2.0 resource server) to protect your APIs with OneLogin. Required: name. Optional: description, connector_id (omit to use the account default API authorization connector), and a nested configuration object ({audiences, resource_identifier, access_token_expiration_minutes, refresh_token_expiration_minutes}). For convenience this tool also accepts top-level audi

• create_appwrite action

  Create a new app based on a OneLogin connector. Minimum required: connector_id and name. For OIDC apps, use configuration to set login_url, redirect_uri, etc. For complete configuration options, use get_app on an existing app with the same connector. For OpenId Connect apps: response includes client_id and client_secret. Returns created app data and x-request-id.

• create_app_rulewrite action

  Create a new mapping rule for an app to automate user attribute management. Required: name (rule name), match ("all"=AND conditions, "any"=OR conditions), conditions array (each with source, operator, value - e.g., {"source":"has_role","operator":"~","value":"765432"}), actions array (each with action and value - e.g., {"action":"add_role","value":"272444"}). Optional: enabled (default true), posi

• create_brandwrite action

  Create a new brand to customize OneLogin portal appearance. Required: name. Configure visual elements: logo_url (header logo), login_logo_url (login page logo), favicon_url, primary_color (hex color for buttons/links), secondary_color, navigation_color, background_image_url (login page background), custom_css (advanced styling), custom_login_page_title, custom_login_page_tagline. Assign to apps or

• create_groupwrite action

  Create a new group with optional policy assignment. Groups are used to organize users and can have policies assigned for access control. Returns created group data with new group ID and x-request-id for log tracing.

• create_mappingwrite action

  Create a new user attribute mapping to control data flow during provisioning. Mappings execute in position order and can conditionally transform user attributes. Required fields: name (descriptive label), match (all/any - how conditions are evaluated), actions (array of action objects with "action" and "value" fields - see list_mapping_actions for available action types like add_role, set_role, se

• create_mapping_actionwrite action

  Add an action to a mapping that transforms user attributes. Actions execute when conditions match. Common action types: "add_role" or "set_role" (assign user to role), "set_group" (assign user to group), "set_department" (set department attribute), "set_status" (set user status), "set_value" (assign static value), "copy_value" (copy from another field), "set_macro" (use OneLogin macro like {firstn

• create_mapping_conditionwrite action

  Add a condition to a mapping that controls when it executes. Conditions check user attributes (source) against values using operators: "==" (equals), "!=" (not equals), ">" (greater), "<" (less), ">=" (gte), "<=" (lte), "in" (contains), "not_in" (not contains), "~" (regex match). Example: source="department", operator="==", value="Engineering" applies mapping only to Engineering users. Returns cre

• create_policywrite action

  Create a security policy. IMPORTANT: requires the Custom Security Policies plan feature - without it the API returns 406. `kind` is required and cannot be changed afterwards: "user" for a policy assigned to users and groups (passwords, lockout, sessions, MFA, portal), "app" for a policy assigned to apps via update_app's policy_id (force_authn, per-app MFA, IP restriction, device trust). Fields bel

• create_privilegewrite action

  Create a new privilege that defines actions on OneLogin resources. Privileges don't grant access until assigned to a user or role. Use wildcard "*" for super user privileges. Don't mix resource classes in the Action array (e.g., don't combine users: and apps: actions in one statement). Requires Delegated Administration subscription. Returns created privilege ID and x-request-id (API v1 - Rate Limi

• delete_api_authorizationwrite action

  Permanently delete an API authorization. WARNING: This removes OAuth scope definitions and revokes all associated client access. Existing access tokens for this authorization become invalid. Client apps will receive authorization errors. Returns 204 No Content on success and x-request-id.

• delete_appwrite action

  Delete an app from OneLogin. WARNING: This operation is final and cannot be undone. If you don't know the app ID, use list_apps to find it. Returns 204 No Content on success and x-request-id.

• delete_app_parameterwrite action

  Delete a custom parameter from an app. WARNING: This operation is final and cannot be undone. You cannot delete connector-level parameters (defined on underlying connector) - only custom app-specific parameters can be deleted. If you don't know the parameter ID, use get_app to retrieve app configuration with parameter IDs. Returns 204 No Content on success or 403 Forbidden if attempting to delete

• delete_app_rulewrite action

  Delete an app rule permanently. WARNING: This operation cannot be undone. Users who were previously affected by this rule will NOT have their existing mappings reverted - deletion only prevents the rule from executing in future. To reverse existing mappings, create a new rule with opposite actions before deletion, then trigger "Reapply Entitlement Mappings" in UI. If you don't know the rule ID, us

• delete_authorization_claimwrite action

  Remove a claim from an API authorization. Claim will no longer appear in newly issued access tokens. Existing tokens with this claim remain valid until expiration. Use to remove unnecessary user data exposure from tokens. Returns success status and x-request-id (API v2).

• delete_brandwrite action

  Permanently delete a brand. WARNING: Apps using this brand will revert to the account default brand. Custom branding settings are lost and cannot be recovered. If you don't know the brand ID, use list_brands to find it. Returns 204 No Content on success and x-request-id.

• delete_groupwrite action

  Delete a group from OneLogin. WARNING: This operation is final and cannot be undone. Users in the group will not be deleted, only the group membership is removed. The group itself is permanently deleted. Returns 204 No Content on success and x-request-id for log tracing.

• delete_mappingwrite action

  Permanently delete a user mapping. WARNING: This operation cannot be undone. Users will no longer have this mapping applied during provisioning. If you don't know the mapping ID, use list_mappings to find it. Returns 204 No Content on success and x-request-id.

• delete_mapping_actionwrite action

  Remove an action from a mapping. The attribute transformation defined by this action will no longer execute. Mapping continues to run other configured actions. Returns 204 No Content on success and x-request-id.

• delete_mapping_conditionwrite action

  Remove a condition from a mapping. Mapping will execute less selectively after condition removal. If all conditions removed, mapping applies to all users (subject to match criteria). Returns 204 No Content on success and x-request-id.

• delete_policywrite action

  Delete a security policy. WARNING: this cannot be undone. Users, groups and apps assigned to the policy are not deleted - their policy assignment is cleared, so they fall back to the account default policy. The account default policy itself cannot be deleted (422) - use set_default_policy to hand that role to another policy first. Returns 204 No Content on success and x-request-id (API v2).

• delete_privilegewrite action

  Delete a privilege. IMPORTANT: Requires Delegated Administration subscription. This removes the privilege definition and unassigns it from all users/roles. Returns success status and x-request-id (API v1 - Rate Limited).

• enroll_factor

  Initiate MFA enrollment for a user. Requires factor_id from get_available_factors. Status will be "pending" if OTP confirmation required (Google Authenticator, OneLogin Protect) or "accepted" if verified=true (SMS, Voice, Email with pre-verified values). For OTP factors, response includes registration_id for verification. Supports custom_message for SMS (max 160 chars), redirect_to for Email Magic

• generate_invite_link

  Generate a password reset invite link for an existing user in OneLogin. Returns the link URL but does NOT send any email - use send_invite_link to email it. Provide link to user to enable them to set password and access OneLogin portal. Email parameter is case-sensitive. Returns invite link and x-request-id (API v1 - Rate Limited).

• generate_mfa_token

  Generate temporary MFA bypass token for account recovery when MFA device is lost. Token can be used in place of MFA for set time period. expires_in defaults to 259200 seconds (72 hours max). reusable defaults to false (single use). Returns mfa_token string, expires_at timestamp, reusable flag, and device_id.

• get_account

  Get a specific child account by ID. Requires reseller privileges. Returns account data including id, name, address (address1, address2, city, state, zip, country), phone, homepage, notes, created_at, updated_at, and assigned roles. Returns x-request-id for log tracing.

• get_api_authorization

  Get detailed configuration of a specific API authorization by ID. Returns complete authorization definition including name, description, audience (unique identifier in JWT tokens), configuration (token lifetime, refresh settings), associated scopes, and authorized client apps. Use to review OAuth resource server configuration. Returns authorization data and x-request-id.

• get_app

  Get configuration settings of an app. Useful for backing up app configuration or cloning apps - take the response and POST it to create_app to clone. Response payload is broken into sections (parameters, sso settings, configuration) that vary based on app type (SAML, OpenId Connect, etc.). Returns complete app configuration and x-request-id for log tracing.

• get_app_rule

  Get detailed configuration of a specific app rule by ID. Returns complete rule definition including name, match type (all=AND conditions, any=OR conditions), enabled status, position in execution order, conditions array (each with source field, operator, and value), and actions array (each with action type and value). Use to review mapping logic or clone rules to other apps. Returns x-request-id (

• get_app_users

  Get a list of users assigned to an app (max 1000 users per page). Supports standard pagination. Returns user list with ID, firstname, lastname, username, and email for each user. Use to audit app access or find users to remove. Returns x-request-id for log tracing.

• get_available_factors

  Get available MFA factors for user enrollment. Returns factors configured in user's policy that are not yet enrolled. Each factor includes factor_id needed for enrollment. Supports OneLogin SMS, Voice, Email, Protect, and authenticator apps. Returns factor list with IDs and x-request-id.

• get_brand

  Get detailed configuration of a specific brand by ID. Returns complete brand settings including name, enabled status, customization options: logo (header, login page, favicon), colors (primary, secondary, navigation), background images, custom CSS, login page copy (title, tagline), email templates, and apps using this brand. Use to review or backup branding configuration. Returns brand data and x-

• get_brand_apps

  Get a list of apps currently using a specific brand. Returns app list with IDs, names, and connector info. Use to understand brand impact before making changes or to audit which apps share branding. Returns app data and x-request-id.

• get_connector

  Get detailed configuration for a specific connector by ID. Returns complete connector definition including name, description, logo_url, auth_method (0=Password, 2=SAML, 8=OIDC, etc.), icon_url, allows_new_parameters (can add custom SAML attributes), default parameters (required config fields), provisioning capabilities (create/update/delete users), and supported features. Use to understand connect

• get_enrolled_factors

  Get enrolled MFA factors (devices) for a user. Returns all factors the user has registered. Each device includes device_id needed for activation and removal. Use before activate_factor or remove_factor to get device IDs. Returns device list with IDs, types, and status.

• get_event

  Get a single event by ID with complete event details including user names, timestamps, IP addresses, risk scores, and resolution data. Returns event data and x-request-id (API v1 - Rate Limited).

• get_group

  Get a single group by ID. Returns group data with ID, name, and reference. Returns x-request-id for log tracing.

• get_group_users

  Get users assigned to a group. Returns a list of users who are members of the specified group with details including ID, email, firstname, lastname. Use this to see group membership. Returns x-request-id for log tracing.

• get_mapping

  Get detailed configuration of a specific user mapping by ID. Returns complete mapping definition including match criteria (all/any), conditions array, actions array, enabled status, position in execution order, and x-request-id. Use to understand how a specific mapping transforms user data.

• get_mapping_actions

  Get all actions configured for a mapping. Actions define the transformations applied to user attributes when mapping conditions match. Common actions: set field value, copy field, transform with macros, map to app parameter. Returns actions array with action type, target fields, values, and x-request-id.

• get_mapping_conditions

  Get all conditions for a mapping. Conditions determine when a mapping applies - they compare user attributes against values using operators (equals, contains, in, etc). Returns conditions array with source field, operator, value, and x-request-id. Use to understand mapping triggering logic.

• get_policy

  Get a single security policy with its full settings. IMPORTANT: the response only contains fields that apply to that policy's kind - an app policy will not include password, session or account-recovery fields at all, and their absence does not mean they are unset. Returns id, name, kind, is_default, every applicable setting, authentication_factor_ids, and x-request-id (API v2).

• get_privilege

  Return a single privilege by ID. IMPORTANT: Requires Delegated Administration subscription. Returns privilege data with ID, name, description, and policy statement (Version, Statement with Effect/Action/Scope). If privilege not found, returns 404. Returns x-request-id (API v1 - Rate Limited).

• get_privilege_roles

  Get list of roles that have been assigned to a specific privilege. IMPORTANT: Requires Delegated Administration subscription. Returns role list with IDs and names and x-request-id (API v1 - Rate Limited).

• get_privilege_users

  Get list of users that have been directly assigned to a specific privilege. IMPORTANT: Requires Delegated Administration subscription. Returns user list with IDs and names and x-request-id (API v1 - Rate Limited).

• get_rate_limit

  Get current rate limit information for the authenticated client. Shows remaining API calls and reset time for rate limiting. Useful for monitoring API usage and avoiding rate limit errors. Returns rate limit data including limit, remaining count, reset timestamp, and x-request-id.

• get_rate_limit_status

  Get current rate limit status for your API client. OneLogin enforces rate limits to prevent API abuse (typically 5000 requests per hour per client_id). Returns current status including limit (max requests per window), remaining (requests left in current window), reset_at (when limit resets, Unix timestamp), window_size (typically 3600 seconds), and throttled (whether you are currently being rate l

• get_rate_limits

  Get rate limit configuration for all OneLogin API endpoints. Different endpoint categories have different limits (e.g., authentication endpoints may have stricter limits than read-only endpoints). Returns comprehensive rate limit rules including endpoint_patterns (URL patterns), methods (GET, POST, PUT, DELETE), limits (requests per hour), burst_limits (requests per minute), and exemptions (privil

• list_accounts

  List child accounts under your reseller account. Requires reseller privileges. Returns account data including id, name, address, city, state, country, zip, phone, homepage, notes, created_at, and updated_at. Returns the full list in one response (the API does not paginate this endpoint). Returns x-request-id for log tracing.

• list_api_authorizations

  Get a list of all API authorizations (resource servers) configured in OneLogin. API authorizations define protected resources that client apps can request access to via OAuth 2.0 scopes. Each authorization has a unique audience identifier and set of allowed scopes. Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor. Returns authorization list

• list_app_rule_actions

  Get available actions for creating app rules. Returns array of action objects showing what operations can be performed in rule actions (e.g., add_role, remove_role, set_attribute, set_parameter_value). Each action includes action type, display label, required value format, and description of effect. Actions vary by app type - SAML apps support different actions than OpenID Connect apps. Use this b

• list_app_rule_conditions

  Get available condition sources for creating app rules. Returns array of condition objects showing what user/group attributes can be used in rule conditions (e.g., has_role, department, group_id, last_login). Each condition includes source name, display label, data type, and supported operators (~, =, !=, >, <, in, not_in, etc.). Use this before creating rules to discover valid condition sources f

• list_app_rules

  Get all mapping rules for an app. App rules act like "if this then that" logic to automate user attribute management, parameters, and entitlements. Each rule has conditions (the "if") and actions (the "then"). IMPORTANT: Rules are not applied automatically when added/modified via API - a user event (create/update) or "Reapply Entitlement Mappings" in UI is required to trigger rule execution. Retur

• list_apps

  Get a list of all apps in a OneLogin account with pagination support (max 1000 per page). Can filter by connector_id or auth_method (0=Password, 1=OpenId, 2=SAML, 3=API, 4=Google, 6=Forms, 7=WSFED, 8=OpenId Connect). Use name parameter with wildcard (*) for partial name search (e.g., name=workday*). Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as

• list_authentication_factors

  List the authentication factors configured on the account, each with id, name and type (OneLogin Protect, SMS, Voice, Email, Yubikey, authenticator apps, etc). Use this to get the IDs for a policy's authentication_factor_ids or reset_password_authentication_factor_ids. IMPORTANT: these are account-level factor definitions, NOT a user's enrolled devices - for those use get_enrolled_factors, and for

• list_authorization_claims

  Get all custom claims defined for an API authorization. Claims are user attributes (email, roles, custom fields) included in access tokens as JWT claims. Returns claim list with IDs, names, user attribute mappings, transformations, and x-request-id. Use to audit what user data is exposed in tokens (API v2).

• list_authorization_scopes

  Get all OAuth 2.0 scopes defined for an API authorization. Scopes control granular permissions (read:users, write:data, etc.). Returns scope list with values, descriptions, and x-request-id. Use to audit what permissions can be requested from this authorization.

• list_authorized_clients

  Get list of client apps (API credentials) authorized to request tokens for this API authorization. Returns client list with IDs, names, client_id values, and granted scopes. Use to audit which apps can access this protected resource. Returns client data and x-request-id.

• list_available_scopes

  Get catalog of all available OAuth 2.0 scopes across all API authorizations in your OneLogin account. Returns comprehensive scope list with values, descriptions, and which authorizations they belong to. Use to discover existing scopes before creating new ones or to standardize scope naming. Returns scope catalog and x-request-id.

• list_brands

  Get a list of all branding configurations in your OneLogin account. Brands control the visual appearance of login pages, portals, and emails. Each brand can be assigned to specific apps or used account-wide. Returns the full list in one response (the API does not paginate this endpoint). Returns brand list with IDs, names, enabled status, custom settings (logo URLs, colors, background images), and

• list_connectors

  Get a list of all available app connectors in the OneLogin catalog. Connectors are pre-built integration templates for SaaS apps (Salesforce, Slack, AWS, Office 365, etc.). Each connector defines SSO configuration, provisioning rules, and attribute mappings. Filter by name to find specific apps (use *wildcards* for partial matches - this is the only search the API offers). Paginate with limit/page

• list_events

  Get a paginated list of events in a OneLogin account (50 events per page). Can filter by event_type_id, user_id, client_id, directory_id, resolution, and date range (since/until with millisecond precision). Pagination is cursor-based: set limit, then pass the response's pagination.after_cursor (next page) or pagination.before_cursor (previous page) back in; there is no page parameter. Returns even

• list_groups

  Get a list of groups in a OneLogin account with pagination and filtering support. Can filter by name (supports wildcards) or reference. To find which group a user belongs to, use get_user. To add/remove users from groups, use update_user. Paginate with limit/page, or pass a previous response's pagination.after_cursor / before_cursor as cursor. Returns group data with ID, name, and reference, a pag

• list_mapping_actions

  Get the complete list of available mapping action types that can be used when creating or updating mappings. Returns all supported actions with their display names and values (e.g., "Set Role"/"add_role", "Set Group"/"set_group", "Set Department"/"set_department"). Use this to discover what action types are available for your OneLogin environment before creating mapping actions. Returns actions li

• list_mappings

  Get a list of all user attribute mappings configured in OneLogin. Mappings control how user data flows between OneLogin and connected apps during provisioning. Filter by enabled status, by condition/action type (builtin, custom, none), or by a specific condition/action in <name>:<value> form. Returns the full list in one response (the API does not support pagination). Returns mapping list with IDs

• list_policies

  Get a list of security policies in a OneLogin account. Filter by kind ("user" for policies assigned to users and groups, "app" for policies assigned to apps) or by name (partial match). IMPORTANT: list responses are brief - only id, name, kind and is_default. Call get_policy for a policy's actual settings. Returns 50 policies per page (max 1000); read total_count from the pagination block to count

• list_privileges

  List privileges created in a OneLogin account. IMPORTANT: Requires Delegated Administration subscription. Privileges define actions that can be performed on resources but don't grant access until assigned to a user or role. Returns the full list in one response (the API does not paginate this endpoint). Returns privilege data with ID, name, description, and policy statement (API v1 - Rate Limited)

• remove_authorization_scopeswrite action

  Remove OAuth 2.0 scopes from an API authorization. Provide scope_ids — the numeric `id` values from list_authorization_scopes (NOT the string scope values). The underlying API deletes one scope per call; we iterate and report per-scope status. Client apps can no longer request removed scopes; existing access tokens remain valid until expiration. Returns a results array with per-scope ok/error stat

• remove_authorized_clientswrite action

  Revoke OIDC client apps from this API authorization. Provide app_ids — the OIDC app IDs (`app_id` field) as returned by list_authorized_clients, NOT a separate client_id. Clients can no longer request new tokens; existing tokens remain valid until expiration. Returns a results array with per-app ok/error status.

• remove_factorwrite action

  Remove an enrolled MFA factor (device) from a user. Requires device_id from get_enrolled_factors. Returns 204 No Content on success. WARNING: This cannot be undone - user will need to re-enroll the factor.

• remove_role_from_privilegewrite action

  Remove a role assignment from a privilege, revoking the privilege's actions from the role's users. IMPORTANT: Requires Delegated Administration subscription. Returns success status and x-request-id (API v1 - Rate Limited).

• remove_user_from_privilegewrite action

  Remove a user assignment from a privilege, revoking the privilege's actions from the user. IMPORTANT: Requires Delegated Administration subscription. Returns success status and x-request-id (API v1 - Rate Limited).

• reorder_app_rules

  Change the execution order of app rules by providing a new sorted array of rule IDs. Rules execute in the order specified by their position, which affects mapping outcomes when multiple rules modify the same attribute. The rule_ids array must include ALL rule IDs for the app in the desired execution order (first ID = position 1, second ID = position 2, etc.). IMPORTANT: Reordering does NOT auto-ap

• revoke_oauth_token

  Revoke an OAuth 2.0 access token immediately. Use this to invalidate a token before its natural expiration (tokens normally expire after 10 hours). Once revoked, the token cannot be used for API requests. Requires the actual access_token value (not the client credentials). Returns success status and x-request-id.

• send_invite_linkwrite action

  Send a password reset invite link email to an existing user in OneLogin. User clicks link to set password and access OneLogin portal. Email parameter is case-sensitive. Use personal_email to send to different address than user's OneLogin email. Returns success message with recipient email and x-request-id (API v1 - Rate Limited).

• set_default_policy

  Make a user policy the account default, applied to every user without a policy of their own or one inherited from a group. IMPORTANT: only works on kind=user policies - an app policy returns 422. This changes authentication behaviour account-wide immediately, so confirm the target policy with get_policy first. The previous default keeps existing and simply stops being the default. Returns the poli

• sort_mappings

  Reorder mapping execution priority by providing array of mapping IDs in desired order. IMPORTANT: Mappings execute sequentially in position order during provisioning - earlier mappings can affect values that later mappings see. Provide complete ordered list of all mapping IDs. Missing mappings may be disabled or repositioned unpredictably. Returns success status and x-request-id.

• update_accountwrite action

  Update a child account. Requires reseller privileges. Partial updates supported - only provide fields to change within the account object (name, address1, address2, city, state, zip, country, phone, homepage, notes). Optionally include api_credential to create new API credentials for the account (requires allow_assuming_users on the account). Returns updated account data and x-request-id for log t

• update_api_authorizationwrite action

  Update an existing API authorization configuration. The OneLogin API requires BOTH auth_id and name on update (it is not a true partial update). Can modify description and nested configuration (audiences, resource_identifier, token expirations). Top-level audience/audiences/resource_identifier/*_expiration_minutes are hoisted into configuration. NOTE: connector_id, scopes, and claims cannot be cha

• update_appwrite action

  Update an existing OneLogin app. Supports partial updates - only provide the fields you want to change. For OIDC apps, use the configuration object to set login_url, redirect_uri, etc. For a complete list of configuration fields for a given app type, use get_app on an existing app with the same connector. Returns updated app data and x-request-id.

• update_app_rulewrite action

  Update an existing app rule. Can modify name, match type, enabled status, position, conditions, or actions. Partial updates supported - only provide fields to change. IMPORTANT: Rules do NOT auto-apply after modification - changes take effect on next user event or when "Reapply Entitlement Mappings" is triggered in UI. Changing position affects execution order which may alter mapping results. Retu

• update_authorization_claimwrite action

  Update an existing claim configuration for an API authorization. Can modify name, user attribute mappings, macros, and transformations. Partial updates supported - only provide fields to change. IMPORTANT: Changing claim mapping will affect all future access tokens. Existing tokens retain old claim values until expiration. Returns updated claim data and x-request-id (API v2).

• update_brandwrite action

  Update an existing brand configuration. Can modify name, enabled status, and any customization settings (logos, colors, backgrounds, custom copy). Partial updates supported - only provide fields to change. Changes apply immediately to login pages and portals using this brand. Returns updated brand data and x-request-id.

• update_groupwrite action

  Update an existing group. Partial updates are supported - only provide the fields you want to change (name, reference, policy_id). Name and reference must remain unique within the account. Returns updated group data and x-request-id for log tracing.

• update_mappingwrite action

  Update an existing user mapping configuration. IMPORTANT: The OneLogin API requires ALL fields when updating - you must provide name, match, enabled, position, conditions (array), and actions (array) even if you only want to change one field. This is a full-replacement API pattern, not a partial update. Best practice: use get_mapping first to retrieve current values, then modify only what you need

• update_mapping_actionwrite action

  Update an existing mapping action configuration. Can change action type (add_role, set_role, set_group, set_department, set_value, etc.), target fields, or transformation values. Use list_mapping_actions to see available action types. Use to modify how user attributes are transformed without recreating the action. Returns updated action data and x-request-id (API v2).

• update_mapping_conditionwrite action

  Update an existing mapping condition. Can change source attribute, operator, or comparison value. Use to adjust when a mapping applies without recreating the entire condition. Returns updated condition data and x-request-id.

• update_policywrite action

  Update a security policy. Partial updates are supported - only supply the fields you want to change. IMPORTANT: `kind` cannot be changed, and a field belonging to the other kind is rejected with 422 naming the field, so check the policy's kind with get_policy first. authentication_factor_ids and reset_password_authentication_factor_ids REPLACE the whole set rather than adding to it - send the full

• update_privilegewrite action

  Update an existing privilege definition. Can update name, description, and/or the policy statement. Requires Delegated Administration subscription. Returns updated privilege data and x-request-id (API v1 - Rate Limited).

• verify_factor

  Authenticate OTP code for SMS, Email, or Authenticator factors. Requires verification_id from activate_factor. Provide the OTP the user entered. Returns success/error status. For Push/Voice/MagicLink factors, use verify_factor_poll instead.

• verify_factor_enrollment_otp

  Verify enrollment using OTP code. Use after enroll_factor returns "pending" status. Provide the registration_id from enrollment response and the OTP the user received/generated. On success, factor becomes active. Works for Google Authenticator, SMS, Email, and Voice factors.

• verify_factor_enrollment_poll

  Poll enrollment status for OneLogin Voice and Protect factors. Use after enroll_factor for these factor types. Poll periodically until status changes from "pending" to "accepted". For Voice: user types OTP into phone. For Protect: user approves on device. Returns registration status.

• verify_factor_poll

  Poll verification status for Push, Voice, and MagicLink factors. Use after activate_factor for these factor types. Poll periodically until status changes to approved/denied. Returns verification status indicating whether user approved the push or completed voice/magiclink.

• Code scan28 source files scanned25/25
• –Live reliabilityno gateway calls yet and no remote to proben/a
• –Tool poisoningtools not inspected (local package is not executed); not countedn/a
• Auth qualitystatic API keys via environment variables6/15
• Maintenancelast push 5 days ago15/15
• Maintainer identityregistry namespace matches repository owner; GitHub account older than a year9/10

Onelogin: common questions

Is Onelogin MCP server safe?

Yes, by our scan: it is graded A (85/100). Read the Onelogin safety report

How do I install Onelogin?

It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.

Does Onelogin need an API key?

Yes. The registry entry asks for ONELOGIN_CLIENT_ID, ONELOGIN_CLIENT_SECRET.

Is Onelogin maintained?

The last commit was 6 days ago (2026-09-14). The latest release is v1.2.1.