Contractor Offboard Across Okta, GitHub, and Slack

arazzo: 1.0.1
info:
  title: Contractor Offboard Across Okta, GitHub, and Slack
  summary: Suspend an Okta user, remove from GitHub org, then remove from Slack.
  description: >-
    A contractor offboarding workflow that suspends a departing contractor in
    Okta to freeze their SSO access, removes them from a GitHub organization to
    cut repository access, and removes them from the Slack workspace. Demonstrates
    a coordinated multi-provider access revocation at end of engagement.
  version: 1.0.0
sourceDescriptions:
  - name: oktaApi
    url: https://raw.githubusercontent.com/api-evangelist/okta/refs/heads/main/openapi/okta-user-api-openapi.yml
    type: openapi
  - name: githubApi
    url: https://raw.githubusercontent.com/api-evangelist/github/refs/heads/main/openapi/_original/github-organizations-openapi.yml
    type: openapi
  - name: slackAdminApi
    url: https://raw.githubusercontent.com/api-evangelist/slack/refs/heads/main/openapi/slack-administrative-api-openapi.yml
    type: openapi
workflows:
  - workflowId: offboard-contractor
    summary: Suspend Okta user, remove from GitHub org, and remove from Slack.
    description: >-
      Suspends a contractor in Okta, removes them from a GitHub organization, and
      removes them from the Slack workspace at end of engagement.
    inputs:
      type: object
      properties:
        oktaUserId:
          type: string
        githubOrg:
          type: string
        githubUsername:
          type: string
        slackTeamId:
          type: string
        slackUserId:
          type: string
    steps:
      - stepId: suspend-okta-user
        description: Suspend the contractor in Okta.
        operationId: $sourceDescriptions.oktaApi.suspendUser
        parameters:
          - name: userId
            in: path
            value: $inputs.oktaUserId
        successCriteria:
          - condition: $statusCode == 200
        outputs:
          suspendStatus: $statusCode
      - stepId: remove-github-membership
        description: Remove the contractor from the GitHub organization.
        operationId: $sourceDescriptions.githubApi.removeOrganizationMembershipForUser
        parameters:
          - name: org
            in: path
            value: $inputs.githubOrg
          - name: username
            in: path
            value: $inputs.githubUsername
        successCriteria:
          - condition: $statusCode == 204
        outputs:
          removeStatus: $statusCode
      - stepId: remove-from-slack
        description: Remove the contractor from the Slack workspace.
        operationId: $sourceDescriptions.slackAdminApi.postAdminUsersRemove
        requestBody:
          contentType: application/x-www-form-urlencoded
          payload:
            team_id: $inputs.slackTeamId
            user_id: $inputs.slackUserId
        successCriteria:
          - condition: $statusCode == 200
        outputs:
          slackOk: $response.body#/ok
    outputs:
      suspendStatus: $steps.suspend-okta-user.outputs.suspendStatus
      removeStatus: $steps.remove-github-membership.outputs.removeStatus
      slackOk: $steps.remove-from-slack.outputs.slackOk