Entra User Create to Group to Slack Welcome

arazzo: 1.0.1
info:
  title: Entra User Create to Group to Slack Welcome
  summary: Create a Microsoft Entra user, add them to a group, then post a Slack welcome.
  description: >-
    An identity onboarding workflow that provisions a new user in Microsoft Entra
    ID, adds the freshly created user to a target security group, and announces
    the new hire with a welcome message in a Slack channel. Chains the created
    user id into the group membership call and surfaces it in the Slack message.
  version: 1.0.0
sourceDescriptions:
  - name: entraApi
    url: https://raw.githubusercontent.com/api-evangelist/microsoft-entra/refs/heads/main/openapi/microsoft-entra-graph-identity-openapi.yml
    type: openapi
  - name: slackApi
    url: https://raw.githubusercontent.com/api-evangelist/slack/refs/heads/main/openapi/slack-chat-openapi.yml
    type: openapi
workflows:
  - workflowId: create-user-add-group-welcome
    summary: Provision an Entra user, add to a group, and send a Slack welcome.
    description: >-
      Creates a user in Microsoft Entra ID, adds the new user to a security
      group by directory object reference, and posts a welcome message naming
      the new hire to a Slack channel.
    inputs:
      type: object
      properties:
        displayName:
          type: string
        userPrincipalName:
          type: string
        mailNickname:
          type: string
        password:
          type: string
        groupId:
          type: string
        slackChannel:
          type: string
    steps:
      - stepId: create-user
        description: Provision the new user account in Microsoft Entra ID.
        operationId: $sourceDescriptions.entraApi.createUser
        requestBody:
          contentType: application/json
          payload:
            accountEnabled: true
            displayName: $inputs.displayName
            userPrincipalName: $inputs.userPrincipalName
            mailNickname: $inputs.mailNickname
            passwordProfile:
              forceChangePasswordNextSignIn: true
              password: $inputs.password
        successCriteria:
          - condition: $statusCode == 201
        outputs:
          userId: $response.body#/id
          userPrincipalName: $response.body#/userPrincipalName
      - stepId: add-to-group
        description: Add the newly created user to the target Entra group.
        operationId: $sourceDescriptions.entraApi.addGroupMember
        parameters:
          - name: group-id
            in: path
            value: $inputs.groupId
        requestBody:
          contentType: application/json
          payload:
            "@odata.id": https://graph.microsoft.com/v1.0/directoryObjects/$steps.create-user.outputs.userId
        successCriteria:
          - condition: $statusCode == 204
        outputs:
          membershipStatus: $statusCode
      - stepId: slack-welcome
        description: Post a welcome message for the new hire to a Slack channel.
        operationId: $sourceDescriptions.slackApi.postChatPostmessage
        requestBody:
          contentType: application/json
          payload:
            channel: $inputs.slackChannel
            text: Welcome aboard $inputs.displayName! Your account has been provisioned.
        successCriteria:
          - condition: $statusCode == 200
        outputs:
          messageTs: $response.body#/ts
    outputs:
      userId: $steps.create-user.outputs.userId
      membershipStatus: $steps.add-to-group.outputs.membershipStatus
      messageTs: $steps.slack-welcome.outputs.messageTs