Log every offboarding to Slack, Sheets, and your audit trail

Run this as a webhook workflow. WorkOS should call it whenever Directory Sync reports that a user has been deactivated or removed from a customer's corporate directory: the dsync.user.deleted event, and dsync.user.updated when the user's state changes to inactive or suspended. Every delivery represents exactly one offboarding to record.

From the webhook payload, pull five values and reuse them everywhere downstream: the event timestamp (this is the date), the directory user's primary email address, the WorkOS organization id the directory belongs to, the directory id the change came from, and the event type. Do not summarize, score, enrich, or interpret anything. Every step below is a fixed field mapping.

First, use Slack Send a Message to post to our IT security channel. The message states that a directory user was deprovisioned and lists the user's email address, the organization, the directory the change came from, the event type, and when it happened. Use the same message format on every run.

Second, use Google Sheets Append Values to add one row to our running deprovisioning log. The columns are fixed and always in this order: date, email, organization, directory, event type. Append only, never overwrite, and never add, reorder, or rename columns between runs so the sheet stays sortable and auditable.

Third, use WorkOS Create an Audit Log Event to write the removal into the customer's own audit trail. Set organization_id to the organization from the payload, use a single consistent action name such as user.deprovisioned on every run, map the directory user as the actor and the same user plus the directory as the targets, and set occurred_at from the event timestamp.

WorkOS can redeliver a webhook, and a double-logged termination inside a compliance record is a real problem. Send an Idempotency-Key request header on the audit log write, set to the WorkOS event id, so a repeated delivery does not create a second entry.

Keep this fully deterministic: no branching, no reasoning step, no optional fields, no judgement calls. If a value is missing from the payload, write an empty cell rather than guessing, and still post to Slack and still write the audit log event.