Fhi @Noctera i am not sure if i understand your use case. are you talking about zitadel actions? if so when do you need to trigger an action
Fand what do you mean with i need to check beforehand? before what? for me it feels like this is the business logic of your application and you will have to implement that in there.
Fso i don't see a problem. but maybe i missunderstand what you try to achieve
_Here is how i do it: I use a service user in zitadel, and use its clientId and secret to be able to hit the endpoints in zitadel.
i route the customer creation through my backend app, i create a customer in my backend i create an organization with the customer as an org manager viewer (i believe this is read only he can't update anything, if not you can create custom role in defaults.yaml file with read only permission) , and then i create the user and org in my internal tables (just the id, external id, and name), also the user creation is the same, i use the api, i check the seats and license first in my backend app and then let the customer invite the users to his organization. (everything is done by the user service in zitadel by calling from my backend)
i route the customer creation through my backend app, i create a customer in my backend i create an organization with the customer as an org manager viewer (i believe this is read only he can't update anything, if not you can create custom role in defaults.yaml file with read only permission) , and then i create the user and org in my internal tables (just the id, external id, and name), also the user creation is the same, i use the api, i check the seats and license first in my backend app and then let the customer invite the users to his organization. (everything is done by the user service in zitadel by calling from my backend)
Fjust to clarify some things, for the use case you have described, yes actions would work, but i think it will be actions v2, as you will use it on the create user request, those actions are currently only on the isntance level. so you would not have the problem that your customers will see the configured actions.
Falso those actions you can't specify the javascript within ZITADEL, its rather like a webhook where you call an endpoint on your side which will run the code, so again no problem that you users could see it