How do you grant and revoke employee access?
An administrator invites a new employee to Pachca in Members, and the Access bot automatically posts a card to the administrators’ chat: who’s starting, which department they’re joining and which services that department needs. An admin grants access and clicks Granted. When the employee is deactivated or deleted, the same bot posts a revocation card with the same list. Walk through it yourself below.
Members
24 members · Pachca team
| Name | Title | Department | Role | Status |
|---|---|---|---|---|
 Daniel Reed | CEO | Management | Owner | Active |
 Rachel Moore | HR manager | HR | Administrator | Active |
 Eric Sullivan | System administrator | IT | Administrator | Active |
 Owen Parker | Head of Sales | Sales | Employee | Active |
 Megan Foster | Marketing specialist | Marketing | Employee | Active |
| SOSarah Olsen | Content manager | Marketing | Employee | Invited |
HR manager Rachel Moore invites Ethan Clark to the workspace. Click Add member and send the invite.
Why manage access in your team chat
As long as admins hear about a new hire from an email, a DM or a hallway chat, some access gets granted late, and when someone leaves, you have to piece the list of services together all over again.
- No request to file. The checklist kicks off the moment someone joins Pachca. HR invites the employee in Members, and admins already see what to grant, no emails or DMs needed.
- New hires have access on day one. The invite goes out ahead of time, and the card shows up the moment it’s sent, not on the morning the new hire is sitting there without email.
- No need to remember the set of services every time. The bot pulls the list by department or by group tag from the profile: CRM and phone system for sales, the repository and VPN for engineering. Same requests, same checklists.
- Nothing slips through when someone leaves. Deactivating or deleting a member creates an “Access revocation” card with the same list that was granted. No need to remember what was set up a year ago.
- You can see who granted what. In the Access chat, every card shows “Granted: name, time.” Questions live in the thread under it, the bot loops in HR with a mention and nobody else gets distracted.
- Grows with you. Today the bot keeps the log and a person grants access. Tomorrow n8n or your own script creates the mailbox and sends the repository invite, and the card stays the same log.
How to set it up
10 minutes without a bot or about an hour with n8n, no developer needed. You'll need administrator rights in Pachca.
In Pachca
- 1
Create an Access chat and an admins tag
+ next to search Chat. Add the people who grant access, plus HR. Then go to Members table view select your admins the add tag icon an "admins" tag. Mentioning @admins on a card will notify exactly those people. For option A, that's all you need. - 2
Create an Access bot
Automations Integrations Webhook +. Name the bot "Access." In the API section, copy the token: the handler uses it to post cards. Open the Access chat in the web app and copy the number after chats/ in the address bar. That's the chat ID. - 3
Turn on the member event
In the bot settings, open the Outgoing webhook section, paste the handler URL from option B or C and check the event for workspace member changes (invited, confirmed, suspended, deleted) and button clicks. The bot gets this event without being added to a chat, but it can only post cards in a chat it's a member of. - 4
Add the bot to the chat and test it
Chat settings Add members Integrations Access. Only an admin or the chat's creator can do this. Then go to Members Add member and invite a new employee by email or with a link. The card will show up in the Access chat.
The event handler
Pick one of three options, depending on your setup.
- A
No bot: a template in the chat
Once HR adds an employee in Members, they post a message to the Access chat using this template:
Admins mark access as granted with a ✅ reaction and post what they did in the thread. On the employee's last day, HR copies the same message with the heading "Access revocation." You don't need steps 2–4, but you have to remember each department's checklist yourself.@admins new employee: Ethan Clark · Sales · starts Oct 5 ☐ Email ☐ CRM ☐ VPN ☐ Phone system Once it's done, react with ✅ and post what you did in the thread - B
n8n, no code
A Webhook node in n8n receives the member event (paste its Production URL in step 3). Next, the Pachca node looks up the employee by the ID from the event: name, department, tags. A Switch node picks the set of services by department, and the Pachca node posts a message to the Access chat with a checklist and Granted and Ask for details buttons. A second route: the Granted click event edit the message and add "Granted: name." For suspended and deleted members, use the same chain with the heading "Access revocation." Set up the Pachca node's credential as described in our article on the time-off bot. - C
Your own code: a card per event, plus offboarding
Give this skill to Claude, ChatGPT or Cursor. It covers the workspace member event, picking services by department and tag, a card with a checklist, a Granted button, a revocation card when someone is deactivated and where to host the handler.
In your team
- 5
Agree on who invites and who closes the loop
HR invites the employee to Pachca ahead of time and fills in their department and group tag right away: the handler uses them to pick the set of services. The admin clicks Granted once the whole checklist is done and posts partial progress and questions in the thread. On the employee's last day, HR deactivates or deletes them: Members the three dots next to the employee Deactivate or Delete. The bot will post a revocation card with the same list.
If your company has an employee directory, SSO creates accounts in Pachca and fills in departments and group tags from the directory, so the card arrives with the right set of services from the start. You can also handle onboarding and offboarding through the admin API: the bot gets the member event in that case too. Our Help Center covers how buttons and outgoing webhooks work.
Troubleshooting
- No card after an invite. The workspace member event isn't checked in the outgoing webhook, the bot isn't in the Access chat, or n8n has the Test URL instead of the Production URL.
- The card has the wrong set of services or none at all. The employee's department or tag isn't filled in, so the handler used the default set. Update the profile and sort out the list in the thread.
- Granted doesn't work. Button clicks aren't checked in the bot's outgoing webhook.