create_user
Create User
Create a new user in the OneLogin directory. At minimum, an email or username is required. Optionally set name, department, title, phone, status, group, roles, and custom attributes.
Ask your agent in plain language. Each of these maps to a real tool on the server.
create_user
Create a new user in the OneLogin directory. At minimum, an email or username is required. Optionally set name, department, title, phone, status, group, roles, and custom attributes.
list_apps
List SSO-connected applications in OneLogin. Filter by name (wildcards supported), connector ID, or authentication method. Returns app metadata including auth method, visibility, and timestamps.
update_user
Update an existing user's profile in OneLogin. Supports updating name, email, username, department, title, phone, status, state, group, roles, manager, and custom attributes. Only provided fields are sent. OneLogin mappings and provisioning can run asynchronously; the returned user is an acknowledgment, not proof those workflows have completed.
get_mfa_factors
Retrieve MFA information for a user including both available (unenrolled) factors and enrolled devices. The two reads are not an atomic snapshot and available factors are limited by the user's policy and API support.
manage_user_roles
Assign or remove roles from a OneLogin user. Roles control which applications a user can access. You can assign multiple roles at once or remove specific roles. Removal does not remove roles assigned through mapping or provisioning. Successful acknowledgment does not prove all indirect access is removed.
verify_mfa_factor
Verify an MFA factor enrollment by submitting the OTP code. Use this after enrolling a factor to complete the registration. For push-based factors like OneLogin Protect and Voice, use the poll option to check completion status.
get_app
Retrieve detailed information about a specific OneLogin application by its ID. Returns full configuration including SSO settings, provisioning config, parameters, and role associations.
list_events
Query historical events from your OneLogin account for audit logging, compliance, and reporting. Filter by event type, user, date range, and other attributes. Returns events with actor, target, app, and risk information.
manage_app
Create, update, or delete an SSO-connected application in OneLogin. When creating, a connector ID and name are required. When updating, provide the app ID and any fields to change. When deleting, provide the app ID.
list_users
Search and list users in the OneLogin directory. Supports filtering by name, email, username, directory, external ID, app, and date ranges. Use wildcards (*) in filter values for partial matching.
list_roles
List roles in OneLogin. Roles control user access to applications. Filter by name, app ID, or app name. Optionally include associated apps, users, and admins.
enroll_mfa_factor
Enroll a new MFA factor for a OneLogin user. Supports SMS, Email, Voice, Google Authenticator, OneLogin Protect, and other TOTP authenticators. After enrollment, use the registration ID to verify the factor with an OTP code.
manage_role
Create, update, or delete a role in OneLogin. Roles control which applications users have access to. When creating, provide a name and optionally associate apps, users, and admins. Updates support name only; legacy apps/users/admins update inputs are refused before any change. Use the dedicated role association APIs or admin console for those changes. When deleting, provide the role ID and set action to "delete".
get_user
Retrieve detailed information about a specific OneLogin user by their ID. Returns the full user profile including name, email, status, roles, group, custom attributes, and activity timestamps.
get_event_types
Retrieve all available event types from OneLogin. Each event type has an ID, name, and description. Use these IDs to filter events when querying the events API. Results should be cached as this endpoint is rate-limited.
delete_user
Permanently delete a user from the OneLogin directory. This action cannot be undone.
list_groups
List one native page of groups in OneLogin. Groups function as security boundaries to apply specific security policies to sets of users.
get_group
Read one exact OneLogin group with its native policy, users and administrators. Requires Read All or Manage All API credentials; the API account is not a person identity.
get_role
Read the native base role by its exact numeric ID. This response contains its ID and name; role users, apps and administrators require separate OneLogin association endpoints.
Every client uses the same Magic MCP URL, and so does any other MCP client. Add it once and sign in with SSO.
{"mcpServers": {"metorial": {"url": "<your-magic-mcp-url>"}}}
claude mcp add --transport http metorial <your-magic-mcp-url>
codex mcp add metorial --url <your-magic-mcp-url>codex mcp login metorial
One governed layer for every app your agents reach, not a separate connector per tool.
Read and manage OneLogin users, roles and SSO applications, inspect native groups and audit events, and enroll or verify supported MFA factors using tenant-bound API credentials. API scopes control access; administrative operations can retain audit, notification and provisioning effects.
Common questions about connecting Onelogin to AI agents with Metorial.