Take someone out of every workspace of the organization.

Organization admins only (403 organization_admin_required), on a browser session with a fresh proof in the x-50h-reauth header (401 reauth_required). It needs a person: API keys, connected apps and service accounts get 403 session_required. Every change is written to the organization's audit. The keys and app grants they made for those workspaces stop; their questions stay with the workspaces. Refused while they own a workspace here (409 owns_workspace_in_organization: hand it over first) and for people your identity provider manages (409 scim_managed: remove them there). Their own account is untouched.