{"product_id":"n8n-oauth-risk-triage-claude-slack-for-auto-revoking-apps","title":"n8n OAuth Risk Triage: Claude + Slack for Auto-Revoking Apps","description":"\u003ch3\u003eAuto-triage OAuth app risk every 30 minutes—then revoke or flag with Claude + Slack\u003c\/h3\u003e\n\u003cp\u003eThis n8n workflow detects new or changed OAuth-authorized apps, scores their risk with \u003cstrong\u003eAnthropic Claude\u003c\/strong\u003e, and automatically \u003cstrong\u003erevokes High-risk OAuth grants\u003c\/strong\u003e—while alerting you in \u003cstrong\u003eSlack\u003c\/strong\u003e for review. It continuously learns by updating a baseline whitelist so only meaningful changes are evaluated.\u003c\/p\u003e\n\n\u003ch3\u003eWhat this workflow does\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eRuns on a 30-minute schedule\u003c\/strong\u003e to stay current with OAuth changes.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eFetches the live list of authorized OAuth apps\u003c\/strong\u003e from your identity provider API and \u003cstrong\u003eretrieves the baseline whitelist\u003c\/strong\u003e from a baseline store API.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eCompares live vs. baseline\u003c\/strong\u003e and \u003cstrong\u003estops early\u003c\/strong\u003e if no new apps or scope changes are detected.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eEnriches flagged apps\u003c\/strong\u003e using an \u003cem\u003eapp reputation API\u003c\/em\u003e to add publisher\/domain reputation signals.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eAssigns a risk tier\u003c\/strong\u003e (High\/Medium\/Low) via \u003cstrong\u003eAnthropic Claude\u003c\/strong\u003e, including a short justification; if parsing fails, it defaults to \u003cstrong\u003eMedium\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eActs based on risk:\u003c\/strong\u003e\n    \u003cul\u003e\n      \u003cli\u003e\n\u003cstrong\u003eHigh\u003c\/strong\u003e: \u003cstrong\u003eauto-revokes OAuth grants\u003c\/strong\u003e via the identity provider API and posts a \u003cstrong\u003ecritical Slack alert\u003c\/strong\u003e.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eMedium\u003c\/strong\u003e: posts the app to a \u003cstrong\u003eSlack review channel\u003c\/strong\u003e.\u003c\/li\u003e\n      \u003cli\u003e\n\u003cstrong\u003eLow\u003c\/strong\u003e: silently logs the app outcome.\u003c\/li\u003e\n    \u003c\/ul\u003e\n  \u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eUpserts results back to the baseline store\u003c\/strong\u003e so future runs only evaluate new or changed grants\/scopes.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eUse cases\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003eDetecting unexpected third-party OAuth connections to your SaaS environment.\u003c\/li\u003e\n  \u003cli\u003eReducing OAuth blast radius by automatically revoking \u003cstrong\u003eHigh-risk\u003c\/strong\u003e grants.\u003c\/li\u003e\n  \u003cli\u003eBuilding an auditable workflow where \u003cstrong\u003eMedium-risk\u003c\/strong\u003e apps are reviewed in Slack before approval.\u003c\/li\u003e\n  \u003cli\u003eMaintaining a continuously updated whitelist baseline without manual tracking.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eTechnical details\u003c\/h3\u003e\n\u003cul\u003e\n  \u003cli\u003e\n\u003cstrong\u003eScheduled execution\u003c\/strong\u003e: runs every 30 minutes.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eIntegrations\u003c\/strong\u003e: identity provider API (fetch authorized apps + revoke grants), baseline store API (fetch\/upsert whitelist), app reputation API, \u003cstrong\u003eSlack\u003c\/strong\u003e, and \u003cstrong\u003eAnthropic Claude\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003en8n node approach\u003c\/strong\u003e: \u003cstrong\u003eif\u003c\/strong\u003e, \u003cstrong\u003ecode\u003c\/strong\u003e, \u003cstrong\u003eno op\u003c\/strong\u003e, \u003cstrong\u003ewait\u003c\/strong\u003e, \u003cstrong\u003emerge\u003c\/strong\u003e, \u003cstrong\u003eslack\u003c\/strong\u003e.\u003c\/li\u003e\n  \u003cli\u003e\n\u003cstrong\u003eSetup\u003c\/strong\u003e: configure HTTP header authentication for identity provider and baseline store endpoints.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"N8N Commerce","offers":[{"title":"Default Title","offer_id":45862233768115,"sku":"N8N-18338","price":43.99,"currency_code":"GBP","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0749\/6279\/6723\/files\/lp2DfTgVHGg_EbZDuNGPE_3HLfuOif.png?v=1786957294","url":"https:\/\/buyflowscripts.com\/products\/n8n-oauth-risk-triage-claude-slack-for-auto-revoking-apps","provider":"N8N Commerce","version":"1.0","type":"link"}