Integrations
PurpletGo connects to your SaaS tools so you can revoke access to all systems from a single click - the Nuke button on the IT Revocation stage.
Available integrations
Identity & access
| Tool | What PurpletGo revokes |
|---|---|
| Google Workspace | Suspends the account, signs out all active sessions, revokes third-party OAuth tokens, and removes every Google Group membership |
| Okta | Clears all active sessions, removes every group membership, and deactivates the Okta user |
| Microsoft Entra / Azure AD | Disables the account, revokes all active sign-in sessions, removes group memberships, removes Microsoft 365 licenses, and sets a mailbox out-of-office reply. Optionally adds the user to an org-configured "blocked" group as Conditional Access defense-in-depth |
| JumpCloud | Suspends the account and removes group memberships (blocks all new authentications - JumpCloud's API has no endpoint to force-terminate an already-active session) |
| OneLogin | Logs out every active session, clears the user's group assignment, and suspends the account |
| Ping Identity (PingOne) | Terminates all active sessions, removes group memberships, and disables the account |
Development tools
| Tool | What PurpletGo revokes |
|---|---|
| GitHub | Removes the user from the GitHub organisation |
| GitLab | Removes the user from the connected group, and deactivates the account instance-wide if the token has admin scope |
| Jira Cloud | Deletes the user's Jira account, or removes them from all Jira groups if deletion isn't permitted |
| Linear | Deactivates the user's workspace membership |
Design & productivity
| Tool | What PurpletGo revokes |
|---|---|
| Figma | Removes the user from the connected team |
| Asana | Removes the user from every team in the workspace |
| Notion | Notion's API has no endpoint for removing a workspace member - PurpletGo flags this as a manual step instead of reporting a false success |
Communication
| Tool | What PurpletGo revokes |
|---|---|
| Slack | Deactivates the account and revokes all active sessions. Requires a separate admin-scoped connection (users:read, users:write, admin) from any bot token already connected for notifications |
Microsoft Teams is a notification channel, not an access-revocation integration - connecting it (via an incoming webhook URL) lets PurpletGo post offboarding notifications to a Teams channel, the same way Slack notifications work. There's no automated way to remove a departing employee from Teams; that stays a manual step.
Cloud infrastructure
| Tool | What PurpletGo revokes |
|---|---|
| AWS | Deletes all IAM access keys, attaches a DenyAll inline policy, and removes the console login profile. Orgs with strict credential-isolation policies can instead configure cross-account STS AssumeRole so PurpletGo never stores a long-lived AWS credential at all |
Alumni engagement (rehire tracking)
Sync only ever fires for alumni who have explicitly opted into the alumni network - connecting a provider here only stores credentials, it never sends data by itself.
| Tool | What PurpletGo syncs |
|---|---|
| Mailchimp | Upserts an opted-in alumni as a subscriber, tagged alumni |
| HubSpot | Upserts an opted-in alumni as a CRM contact with a rehire-eligibility property |
| Salesforce | Upserts an opted-in alumni as a Contact (matched by email) for orgs that run rehire tracking through Salesforce instead of a marketing CRM |
HRIS (data sync)
| Tool | What PurpletGo syncs |
|---|---|
| BambooHR | Employee records sync, auto-creates offboarding on termination |
| Workday | Employee records sync, auto-creates offboarding on termination |
| Rippling | Employee records sync, auto-creates offboarding on termination |
| Gusto | Employee records sync, auto-creates offboarding on termination |
| ADP Workforce Now | Employee records sync, auto-creates offboarding on termination |
| Paychex | Employee records sync, auto-creates offboarding on termination |
| TriNet | Employee records sync, auto-creates offboarding on termination |
| BDP (Benefitplace) | Employee records sync, auto-creates offboarding on termination |
| Justworks | Employee records sync, auto-creates offboarding on termination |
| Zenefits | Employee records sync, auto-creates offboarding on termination |
Scheduling (exit interviews)
| Tool | What PurpletGo uses |
|---|---|
| Google Calendar | Schedule exit interview meetings |
| Calendly | Book exit interviews via Calendly event types |
Connecting an integration
- Go to Integrations in the main navigation
- Find the tool you want to connect - access-revocation tools (Jira Cloud, Figma, Asana, Linear, GitLab, Notion, Slack Admin, AWS) are under the SaaS Access Revocation section
- Click Connect and follow the OAuth or API key flow
- Once connected, the integration will show a green Connected badge
If you already connected Jira for IT ticketing or Slack for notifications, connect them again under SaaS Access Revocation. Revoking access requires admin-scoped credentials that a ticketing or notification token isn't guaranteed to have.
Integration credentials are encrypted at rest using AES-256-GCM. PurpletGo never stores OAuth refresh tokens in plain text.
Triggering access revocation
When an offboarding reaches the IT Revocation stage:
- Open the offboarding detail
- Go to the IT Revocation section
- Review the list of apps the employee has access to
- Click Nuke Access to revoke all listed apps simultaneously
Each revocation attempt is logged to the audit trail with status (success / failure) and timestamp.
HRIS sync
When an HRIS integration is connected, PurpletGo can:
- Pull employees - sync your roster from BambooHR / Workday / etc. directly into PurpletGo's directory
- Trigger offboardings - automatically start an offboarding when an employee is marked as departed in your HRIS
To enable HRIS sync: Integrations → HRIS → Configure → Enable auto-sync.
Webhooks (outbound)
If your tool isn't listed, you can use Webhooks to build your own integration. PurpletGo can POST events to any HTTPS endpoint when key offboarding events occur.
See Webhooks in the API reference for the full event list and payload schema.