n8n OAuth Risk Triage: Claude + Slack for Auto-Revoking Apps

Auto-triage OAuth app risk every 30 minutes—then revoke or flag with Claude + Slack

This n8n workflow detects new or changed OAuth-authorized apps, scores their risk with Anthropic Claude, and automatically revokes High-risk OAuth grants—while alerting you in Slack for review. It continuously learns by updating a baseline whitelist so only meaningful changes are evaluated.

What this workflow does

• Runs on a 30-minute schedule to stay current with OAuth changes.
• Fetches the live list of authorized OAuth apps from your identity provider API and retrieves the baseline whitelist from a baseline store API.
• Compares live vs. baseline and stops early if no new apps or scope changes are detected.
• Enriches flagged apps using an app reputation API to add publisher/domain reputation signals.
• Assigns a risk tier (High/Medium/Low) via Anthropic Claude, including a short justification; if parsing fails, it defaults to Medium.
• Acts based on risk:
  • High: auto-revokes OAuth grants via the identity provider API and posts a critical Slack alert.
  • Medium: posts the app to a Slack review channel.
  • Low: silently logs the app outcome.
• Upserts results back to the baseline store so future runs only evaluate new or changed grants/scopes.

Use cases

• Detecting unexpected third-party OAuth connections to your SaaS environment.
• Reducing OAuth blast radius by automatically revoking High-risk grants.
• Building an auditable workflow where Medium-risk apps are reviewed in Slack before approval.
• Maintaining a continuously updated whitelist baseline without manual tracking.

Technical details

• Scheduled execution: runs every 30 minutes.
• Integrations: identity provider API (fetch authorized apps + revoke grants), baseline store API (fetch/upsert whitelist), app reputation API, Slack, and Anthropic Claude.
• n8n node approach: if, code, no op, wait, merge, slack.
• Setup: configure HTTP header authentication for identity provider and baseline store endpoints.