How do AI agents use Okta through Open Connector?

Your user connects Okta once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Okta tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Okta MCP server?

Yes. Open Connector can serve Okta as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Okta actions with credentials injected server-side.

Where do Okta credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Okta integration

Okta integration for AI agents.

Okta integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Okta tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real Okta actions, managed and audited.

Your user connects Okta once; your agent can then secure AI-agent actions — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants Okta access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Okta tools.

734 tools are generated from the published Okta catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 734 tools. All published catalog entries are included in this page's server-rendered HTML.

Activate an agent pool update: Activates a scheduled agent pool update; AgentPools
Activate an API service integration instance secret: Activates an API Service Integration instance Secret by `secretId`; ApiServiceIntegrations
Activate an application: Activates an inactive application; Application
Activate an authenticator: Activates an authenticator by `authenticatorId`; Authenticator
Activate an authenticator method: Activates a method for an authenticator identified by `authenticatorId` and `methodType`; Authenticator
Activate an authorization server: Activates an authorization server; AuthorizationServer
Activate a policy: Activates an authorization server policy; AuthorizationServerPolicies
Activate a policy rule: Activates an authorization server policy rule; AuthorizationServerRules
Activate a behavior detection rule: Activates a behavior detection rule; Behavior
Activate a custom telephony provider: Activates a custom telephony provider by its ID. You must activate a provider before it can be used.; CustomTelephonyProvider
Activate the default provisioning connection: Activates the default provisioning connection for an app; ApplicationConnections
Activate a device: Activates a device by setting its status to `ACTIVE` by `deviceId`. Activated devices are used to create and delete device user links.; Device
Activate a device integration: Activates a device integration and populates the related configurations by `deviceIntegrationId`; DeviceIntegrations
Activate an event hook: Activates the event hook that matches the provided `id`; EventHook
Activate a factor: Activates a factor. Some factors (`call`, `email`, `push`, `sms`, `token:software:totp`, `u2f`, and `webauthn`) require activation to complete the enrollment process. Okta enforces a rate limit of five activation attempts within five minutes. After a user exceeds the rate limit, Okta returns an error message. > **Notes:** > * If the user exceeds their SMS, call, or email factor activation rate limit, then an [OTP resend request](./#tag/UserFactor/operation/resendEnrollFactor) isn't allowed for the same factor. > * You can't use the Factors API to activate Okta FastPass (`signed_nonce`) for a user. See [Configure Okta FastPass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure).; UserFactor
Activate a group rule: Activates a specific group rule by ID from your org; GroupRule
Activate an IdP: Activates an inactive identity provider (IdP); IdentityProvider
Activate an inline hook: Activates the inline hook by `inlineHookId`; InlineHook
Activate a log stream: Activates a log stream by `logStreamId`; LogStream
Activate a network zone: Activates a Network Zone by `zoneId`; NetworkZone
Activate an OAuth 2.0 client JSON Web Key: Activates an OAuth 2.0 client JSON Web Key by `keyId` > **Note:** You can have only one active encryption key at any given time for an app. When you activate an inactive key, the current active key is automatically deactivated.; ApplicationSSOPublicKeys
Activate an OAuth 2.0 client secret: Activates an OAuth 2.0 client secret by `secretId`; ApplicationSSOPublicKeys
Activate a Custom Authorization Server Public JSON Web Key: Activates a custom authorization server public JSON web key by key `id`. > **Note:** You can have only one active key at any given time for the authorization server. When you activate an inactive key, Okta automatically deactivates the current active key.; OAuth2ResourceServerCredentialsKeys
Activate a policy: Activates a policy; Policy
Activate a policy rule: Activates a policy rule identified by `policyId` and `ruleId`; Policy
Activate a preregistered WebAuthn factor: Activates a preregistered WebAuthn factor. As part of this operation, Okta first decrypts and verifies the factor PIN and enrollment data sent by the fulfillment provider.; WebAuthnPreregistration
Activate a realm assignment: Activates a realm assignment; RealmAssignment
Activate a security events provider: Activates a security events provider instance by setting its status to `ACTIVE`. This operation resumes the flow of events from the security events provider to Okta.; SSFReceiver
Activate a trusted origin: Activates a trusted origin. Sets the `status` to `ACTIVE`.; TrustedOrigin
Activate a user: Activates a user. Perform this operation only on users with a `STAGED` or `DEPROVISIONED` status. Activation of a user is an asynchronous operation. * The user has the `transitioningToStatus` property with an `ACTIVE` value during activation. This indicates that the user hasn't completed the asynchronous operation. * The user has an `ACTIVE` status when the activation process completes. Users who don't have a password must complete the welcome flow by visiting the activation link to complete the transition to `ACTIVE` status. > **Note:** If you want to send a branded user activation email, change the subdomain of your request to the custom domain that's associated with the brand. > For example, change `subdomain.okta.com` to `custom.domain.one`. See [Multibrand and custom domains](https://developer.okta.com/docs/concepts/brands/#multibrand-and-custom-domains). > **Note:** If you have optional password enabled, visiting the activation link is optional for users who aren't required to enroll a password. > See [Create user with optional password](/openapi/okta-management/management/user/create-user-with-optional-password#user/Create-user-with-optional-password). > **Legal disclaimer** > After a user is added to the Okta directory, they receive an activation email. As part of signing up for this service, > you agreed not to use Okta's service/product to spam and/or send unsolicited messages. > Please refrain from adding unrelated accounts to the directory as Okta is not responsible for, and disclaims any and all > liability associated with, the activation email's content. You, and you alone, bear responsibility for the emails sent to any recipients.; UserLifecycle
Add a group: Adds a new group with the `OKTA_GROUP` type to your org. > **Note:** App import operations are responsible for syncing groups with `APP_GROUP` type such as Active Directory groups. See [About groups](https://help.okta.com/okta_help.htm?id=Directory_Groups) in the help documentation.; Group
Add a JSON Web Key: Adds a new JSON Web Key to the client`s JSON Web Keys. > **Note:** This API doesn't allow you to add a key if the existing key doesn't have a `kid`. This is also consistent with how the [Dynamic Client Registration](/openapi/okta-oauth/oauth/client) or [Applications](/openapi/okta-management/management/tags/application) APIs behave, as they don't allow the creation of multiple keys without `kids`. Use the [Replace an Application](/openapi/okta-management/management/application/replaceapplication) or the [Replace a Client Application](/openapi/okta-oauth/oauth/client/replaceclient) operation to update the JWKS or [Delete an OAuth 2.0 Client JSON Web Key](/openapi/okta-management/management/applicationssopublickeys/deletejwk) and re-add the key with a `kid`.; ApplicationSSOPublicKeys
Add more role resource set binding members: Adds more members to a role resource set binding; RoleDResourceSetBindingMember
Add a JSON Web Key: Adds a new JSON Web Key to the custom authorization server`s JSON web keys. > **Note:** This API doesn't allow you to add a key if the existing key doesn't have a `kid`. Use the [Replace an Authorization Server](/openapi/okta-management/management/authorizationserver/replaceauthorizationserver) operation to update the JWKS or [Delete a Custom Authorization Server Public JSON Web Key](/openapi/okta-management/management/oauth2resourceservercredentialskeys/deleteoauth2resourceserverjsonwebkey) and re-add the key with a `kid`. > **Note:** This API doesn't allow you to add a key with an ACTIVE status. You need to add an INACTIVE key first, and then ACTIVATE the key.; OAuth2ResourceServerCredentialsKeys
Add a resource set resource with conditions: Adds a resource with conditions for a resource set; RoleCResourceSetResource
Add more resources to a resource set: Adds more resources to a resource set; RoleCResourceSetResource
Assign all apps as target to admin role: Assigns all apps as target to an `APP_ADMIN` role; RoleBTargetAdmin
Assign a group role app instance target: Assigns an app instance target to an `APP_ADMIN` role assignment to a group. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. > **Note:** You can target a mixture of both OIN app and app instance targets, but you can't assign permissions to manage all instances of an OIN app and then assign a subset of permissions to the same app. > For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.; RoleBTargetBGroup
Assign an admin role app instance target: Assigns an app instance target to an `APP_ADMIN` role assignment to an admin user. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. > **Note:** You can target a mixture of both OIN app and app instance targets, but can't assign permissions to manage all instances of an OIN app and then assign a subset of permission to the same OIN app. > For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.; RoleBTargetAdmin
Assign a client role app instance target: Assigns an app instance target to an `APP_ADMIN` role assignment to a client. When you assign the first OIN app or app instance target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. > **Note:** You can target a mixture of both OIN app and app instance targets, but you can't assign permissions to manage all instances of an OIN app and then assign a subset of permissions to the same app. For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage only specific configurations of the Salesforce app.; RoleBTargetClient
Assign a client role app target: Assigns an OIN app target for an `APP_ADMIN` role assignment to a client. When you assign an app target from the OIN catalog, you reduce the scope of the role assignment. The role assignment applies to only app instances that are included in the specified OIN app target. An assigned OIN app target overrides any existing app instance targets. For example, if a user is assigned to administer a specific Facebook instance, a successful request to add an OIN app target with `facebook` for `appName` makes that user the administrator for all Facebook instances.; RoleBTargetClient
Assign a group role app target: Assigns an OIN app target to an `APP_ADMIN` role assignment to a group. When you assign the first OIN app target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. An OIN app target that's assigned to the role overrides any existing instance targets of the OIN app. For example, if a user is assigned to administer a specific Facebook instance, a successful request to add an OIN app with `facebook` for `appName` makes that user the administrator for all Facebook instances.; RoleBTargetBGroup
Assign an admin role app target: Assigns an OIN app target for an `APP_ADMIN` role assignment to an admin user. When you assign the first app target, you reduce the scope of the role assignment. The role no longer applies to all app targets, but applies only to the specified target. Assigning an OIN app target overrides any existing app instance targets of the OIN app. For example, if a user was assigned to administer a specific Facebook instance, a successful request to add an OIN app target with `facebook` for `appName` makes that user the admin for all Facebook instances.; RoleBTargetAdmin
Assign an app sign-in policy: Assigns an app to an [app sign-in policy](/openapi/okta-management/management/tags/policy/), identified by `policyId`. If the app was previously assigned to another policy, this operation replaces that assignment with the updated policy identified by `policyId`. > **Note:** When you [merge duplicate app sign-in policies](https://help.okta.com/okta_help.htm?type=oie&id=ext-merge-auth-policies), the policy and mapping CRUD operations may be unavailable during the consolidation. When the consolidation is complete, you receive an email with merged results.; ApplicationPolicies
Assign the default public client app role setting: Assigns the [Super Admin role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin) as the default role for new public client apps; OrgSettingAdmin
Assign the fulfillment error status to a WebAuthn preregistration factor: Assigns the fulfillment error status to a WebAuthn preregistration factor for a user. The `/mark-error` path indicates that the specific `FULFILLMENT_ERRORED` AuthFactor status is set on the enrollment.; WebAuthnPreregistration
Assign a group owner: Assigns a group owner; GroupOwner
Assign a client role group target: Assigns a group target to a [`USER_ADMIN`](/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a client app. When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets, but applies only to the specified target.; RoleBTargetClient
Assign a group role group target: Assigns a group target to a [`USER_ADMIN`](/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a group. When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets but applies only to the specified target.; RoleBTargetBGroup
Assign an admin role group target: Assigns a group target for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. When you assign the first group target, you reduce the scope of the role assignment. The role no longer applies to all targets but applies only to the specified target.; RoleBTargetAdmin
Assign an application group: Assigns a [Group](/openapi/okta-management/management/tags/group) to an app, which in turn assigns the app to each [User](/openapi/okta-management/management/tags/user) that belongs to the group. The resulting application user [scope](/openapi/okta-management/management/applicationusers/listapplicationusers#applicationusers/listapplicationusers/t=response&c=200&path=scope) is `GROUP` since the assignment was from the group membership.; ApplicationGroups
Assign a linked object value for primary: Assigns the first user as the `associated` and the second user as the `primary` for the specified relationship. If the first user is already associated with a different `primary` for this relationship, the previous link is removed. A linked object relationship can specify only one primary user for an associated user.; UserLinkedObject
Assign a client role: Assigns a [standard role](/openapi/okta-management/guides/roles/#standard-roles) to a client app. You can also assign a custom role to a client app, but the preferred method to assign a custom role to a client is to create a binding between the custom role, the resource set, and the client app. See [Create a role resource set binding](/openapi/okta-management/management/roledresourcesetbinding/createresourcesetbinding). > **Notes:** > * The request payload is different for standard and custom role assignments. > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.; RoleAssignmentClient
Assign a role to a group: Assigns a [standard role](/openapi/okta-management/guides/roles/#standard-roles) to a group. You can also assign a custom role to a group, but the preferred method to assign a custom role to a group is to create a binding between the custom role, the resource set, and the group. See [Create a role resource set binding](/openapi/okta-management/management/roledresourcesetbinding/createresourcesetbinding). > **Notes:** > * The request payload is different for standard and custom role assignments. > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.; RoleAssignmentBGroup
Assign a user role: Assigns a [standard role](/openapi/okta-management/guides/roles/#standard-roles) to a user. You can also assign a custom role to a user, but the preferred method to assign a custom role to a user is to create a binding between the custom role, the resource set, and the user. See [Create a role resource set binding](/openapi/okta-management/management/roledresourcesetbinding/createresourcesetbinding). > **Notes:** > * The request payload is different for standard and custom role assignments. > * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.; RoleAssignmentAUser
Assign an application user: Assigns a user to an app for: * SSO only Assignments to SSO apps typically don't include a user profile. However, if your SSO app requires a profile but doesn't have provisioning enabled, you can add profile attributes in the request body. * SSO and provisioning Assignments to SSO and provisioning apps typically include credentials and an app-specific profile. Profile mappings defined for the app are applied first before applying any profile properties that are specified in the request body. > **Notes:** > * When Universal Directory is enabled, you can only specify profile properties that aren't defined in profile mappings. > * Omit mapped properties during assignment to minimize assignment errors.; ApplicationUsers
Assign a user to a group: Assigns a user to a group with the `OKTA_GROUP` type. > **Note:** You only can modify memberships for groups of the `OKTA_GROUP` type. App imports are responsible for managing group memberships for groups of the `APP_GROUP` type, such as Active Directory groups.; Group
Remove bounced emails: Removes emails from an email service bounce list. The emails submitted in this operation are removed from the bounce list by an asynchronous job. Any email address that passes validation is accepted for the removal process, even if there are other email addresses in the request that failed validation. > **Note:** If there are validation errors for all email addresses, a `200 OK` HTTP status is still returned.; EmailCustomization
Update password: Updates a user's password by validating the user's current password. This operation provides an option to delete all the sessions of the specified user. However, if the request is made in the context of a session owned by the specified user, that session isn't cleared. You can only perform this operation on users in `STAGED`, `ACTIVE`, `PASSWORD_EXPIRED`, or `RECOVERY` status that have a valid [password credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request). The user transitions to `ACTIVE` status when successfully invoked in `RECOVERY` status. > **Note:** The Okta account management policy doesn't support the `/users/{userId}/credentials/change_password` endpoint. See [Configure an Okta account management policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/).; UserCred
Update recovery question: Updates a user's recovery question and answer credential by validating the user's current password. You can only perform this operation on users in `STAGED`, `ACTIVE`, or `RECOVERY` status that have a valid [password credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request).; UserCred
Clone a key credential: Clones an X.509 certificate for an application key credential from a source app to a target app. For step-by-step instructions to clone a credential, see [Share application key credentials for IdPs across apps](https://developer.okta.com/docs/guides/sharing-cert/main/). > **Note:** Sharing certificates isn't a recommended security practice.; ApplicationSSOCredentialKey
Clone a signing key credential for IdP: Clones an X.509 certificate for an identity provider (IdP) signing key credential from a source IdP to target IdP > **Caution:** Sharing certificates isn't a recommended security practice. > **Note:** If the key is already present in the list of key credentials for the target IdP, you receive a 400 error response.; IdentityProviderSigningKeys
Clone an existing policy: Clones an existing policy; Policy
Create an agent pool update: Creates an agent pool update; AgentPools
Create an API service integration instance: Creates and authorizes an API Service Integration instance; ApiServiceIntegrations
Create an API service integration instance secret: Creates an API Service Integration instance Secret object with a new active client secret. You can create up to two Secret objects. An error is returned if you attempt to create more than two Secret objects.; ApiServiceIntegrations
Create an app service account: Creates a new app service account for managing an app account; ServiceAccount
Create an application: Creates an app instance in your Okta org. You can either create an OIN app instance or a custom app instance: * OIN app instances have prescribed `name` (key app definition) and `signOnMode` options. See the [OIN schemas](/openapi/okta-management/management/application/googleapplication) for the request body. * For custom app instances, select the [signOnMode](/openapi/okta-management/management/tags/application/other/createapplication#application/createapplication/t=request&path=&d=0/signonmode) that pertains to your app and specify the required parameters in the request body.; Application
Create an associated authorization server: Creates trusted relationships between the given authorization server and other authorization servers; AuthorizationServerAssoc
Create an authenticator: Creates an authenticator; Authenticator
Create an auto-activated Phone authenticator enrollment: Creates a Phone authenticator enrollment that's automatically activated; UserAuthenticatorEnrollments
Create an authorization server: Creates an authorization server; AuthorizationServer
Create a policy: Creates a policy; AuthorizationServerPolicies
Create a policy rule: Creates a policy rule for the specified Custom Authorization Server and Policy; AuthorizationServerRules
Create a behavior detection rule: Creates a new behavior detection rule; Behavior
Create a brand: Creates a new brand in your org; Brands
Create a CAPTCHA instance: Creates a new CAPTCHA instance. Currently, an org can only configure a single CAPTCHA instance.; CAPTCHA
Create an org: Creates an org (child org) that has the same features as the current requesting org (parent org). A child org inherits any new features added to the parent org, but new features added to the child org aren't propagated back to the parent org. > **Notes:** > * Some features associated with products, such as Atspoke, Workflows, and Okta Identity Governance, aren't propagated to the child org. > * Wait at least 30 seconds after a 201-Created response before you make API requests to the new child org. > * For rate limits, see [Org creation rate limits](https://developer.okta.com/docs/reference/rl-additional-limits/#org-creation-rate-limits).; OrgCreator
Create a Cross App Access connection: Creates a Cross App Access connection; ApplicationCrossAppAccessConnections
Create a custom AAGUID: Creates a custom AAGUID for the Passkey (FIDO2 WebAuthn) authenticator; Authenticator
Create a custom domain: Creates your custom domain; CustomDomain
Create a custom telephony provider: Creates a custom telephony provider with the provided credentials; CustomTelephonyProvider
Create a device assurance policy: Creates a new device assurance policy; DeviceAssurance
Create a device posture check: Creates a device posture check; DevicePostureCheck
Create an email customization: Creates a new Email Customization <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is enabled, you can create a customization for any BCP47 language in addition to the Okta-supported languages.; CustomTemplates
Create an email domain: Creates an Email Domain in your org; EmailDomain
Create a custom SMTP server: Creates a custom email SMTP server configuration for your org. For more information about configuring the OAuth 2.0 authentication methods, see [Custom email providers with OAuth 2.0](https://developer.okta.com/docs/guides/custom-smtp/main/).; EmailServer
Create an event hook: Creates a new event hook for your organization in `ACTIVE` status. You pass an event hook object in the JSON payload of your request. That object represents the set of required information about the event hook you're registering, including: * The URI of your external service * The [events](https://developer.okta.com/docs/reference/api/event-types/) in Okta you want to subscribe to * An optional event hook filter that can reduce the number of event hook calls. This is a self-service Early Access (EA) feature. See [Create an event hook filter](https://developer.okta.com/docs/concepts/event-hooks/#create-an-event-hook-filter). Additionally, you can specify a secret API key for Okta to pass to your external service endpoint for security verification. Note that the API key you set here is unrelated to the Okta API token you must supply when making calls to Okta APIs. Optionally, you can specify extra headers that Okta passes to your external service with each call. Your external service must use a valid HTTPS endpoint.; EventHook
Create a federated claim: Creates a claim that will be included in tokens produced by federation protocols (for example: OIDC `id_tokens` or SAML Assertions); ApplicationSSOFederatedClaims
Create a governance bundle: Creates a governance bundle of entitlements for the Admin Console; GovernanceBundle
Create a group push mapping: Creates or links a group push mapping. **Note:** Either `targetGroupId` or `targetGroupName` must be provided, but not both. If `targetGroupId` is provided, it links to an existing group. If `targetGroupName` is provided, it creates a new group.; GroupPushMapping
Create a group rule: Creates a group rule to dynamically add users to the specified group if they match the condition. > **Note:** Group rules are created with the status set to `'INACTIVE'`.; GroupRule
Create a key: Creates a key for use with other parts of the application, such as inline hooks > **Note:** Use the key name to access this key for inline hook operations. The total number of keys that you can create in an Okta org is limited to 50. The response is a [Key object](https://developer.okta.com/docs/reference/api/hook-keys/#key-object) that represents the key that you create. The `id` property in the response serves as the unique ID for the key, which you can specify when invoking other CRUD operations. The `keyId` provided in the response is the alias of the public key that you can use to get details of the public key data in a separate call. > **Note:** The keyId is the alias of the public key that you can use to retrieve the public key.; HookKey
Create an IdP: Creates a new identity provider (IdP) integration. #### SAML 2.0 IdP You must first add the IdP's signature certificate to the IdP key store before you can add a SAML 2.0 IdP with a `kid` credential reference. Don't use `fromURI` to automatically redirect a user to a particular app after successfully authenticating with a third-party IdP. Instead, use SAML deep links. Using `fromURI` isn't tested or supported. For more information about using deep links when signing users in using an SP-initiated flow, see [Understanding SP-Initiated Login flow](https://developer.okta.com/docs/concepts/saml/#understanding-sp-initiated-login-flow). Use SAML deep links to automatically redirect the user to an app after successfully authenticating with a third-party IdP. To use deep links, assemble these three parts into a URL: * SP ACS URL For example: `https://${yourOktaDomain}/sso/saml2/:idpId` * The app to which the user is automatically redirected after successfully authenticating with the IdP For example: `/app/:app-location/:appId/sso/saml` * Optionally, if the app is an outbound SAML app, you can specify the `relayState` passed to it. For example: `?RelayState=:anyUrlEncodedValue` The deep link for the above three parts is: `https://${yourOktaDomain}/sso/saml2/:idpId/app/:app-location/:appId/sso/saml?RelayState=:anyUrlEncodedValue` #### Smart Card X509 IdP You must first add the IdP's server certificate to the IdP key store before you can add a Smart Card `X509` IdP with a `kid` credential reference. You need to upload the whole trust chain as a single key using the [Key Store API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderKeys/#tag/IdentityProviderKeys/operation/createIdentityProviderKey). Depending on the information stored in the smart card, select the proper [template](https://developer.okta.com/docs/reference/okta-expression-language/#idp-user-profile) `idpuser.subjectAltNameEmail` or `idpuser.subjectAltNameUpn`. #### Identity verification vendors as identity providers Identity verification (IDV) vendors work like IdPs, with a few key differences. IDV vendors verify your user's identities by requiring them to submit a proof of identity. There are many ways to verify user identities. For example, a proof of identity can be a selfie to determine liveliness or it can be requiring users to submit a photo of their driver's license and matching that information with a database. There are three IDV vendors (Persona, CLEAR Verified, and Incode) with specific configuration settings and another IDV vendor type (Custom IDV) that lets you create a custom IDV vendor, using a [standardized IDV process](https://developer.okta.com/docs/guides/idv-integration/main/). You can configure each of the IDV vendors as IdPs in your org by creating an account with the vendor, and then creating an IdP integration. Control how the IDVs verify your users by using [Okta account management policy rules](https://developer.okta.com/docs/guides/okta-account-management-policy/main/). * [Persona](https://withpersona.com/) * [CLEAR Verified](https://www.clearme.com/) * [Incode](https://incode.com/) * [Custom IDV](https://help.okta.com/okta_help.htm?type=oie&id=idp-add-custom-idv-vendor); IdentityProvider
Create an IdP key credential: Creates a new X.509 certificate credential in the identity provider (IdP) key store > **Note:** RSA-based certificates are supported for all IdP types. Okta currently supports EC-based certificates only for the `X509` IdP type. For EC-based certificates we support only P-256, P-384, and P-521 curves.; IdentityProviderKeys
Create an identity source group: Creates a group in an identity source for the given identity source instance; IdentitySource
Create the memberships for the given identity source group: Creates the group memberships for the given identity source group; IdentitySource
Create an identity source session: Creates an identity source session for the given identity source instance; IdentitySource
Create an identity source user: Creates a user in an identity source for the given identity source instance; IdentitySource
Create an inline hook: Creates an inline hook This endpoint creates an inline hook for your org in an `ACTIVE` status. You need to pass an inline hooks object in the JSON payload of your request. That object represents the set of required information about the inline hook that you're registering, including: * The URI of your external service endpoint * The type of inline hook you're registering * The type of authentication you're registering There are two authentication options that you can configure for your inline hook: HTTP headers and OAuth 2.0 tokens. HTTP headers let you specify a secret API key that you want Okta to pass to your external service endpoint (so that your external service can check for its presence as a security measure). >**Note:** The API key that you set here is unrelated to the Okta API token you must supply when making calls to Okta APIs. You can also optionally specify extra headers that you want Okta to pass to your external service with each call. To configure HTTP header authentication, see parameters for the `config` object. OAuth 2.0 tokens provide enhanced security between Okta and your external service. You can configure these tokens for the following types—client secret and private key. >**Note:** Your external service's endpoint needs to be a valid HTTPS endpoint. The URI you specify should always begin with `https://`. The total number of inline hooks that you can create in an Okta org is limited to 50, which is a combined total for any combination of inline hook types.; InlineHook
Create an allowed app mapping for a target app: Creates a mapping between the target app and an allowed app for interclient SSO using the interclient token; ApplicationInterclientTrustMappings
Create a linked object definition: Creates a Linked Object definition; LinkedObject
Create a log stream: Creates a new log stream object; LogStream
Create a network zone: Creates a Network Zone * For an IP Network Zone, you must define either `gateways` or `proxies`. * For a Dynamic Network Zone, you must define at least one of the following: `asns`, `locations`, or `proxyType`. * For an Enhanced Dynamic Network Zone, you must define at least one of the following: `asns`, `locations`, or `ipServiceCategories`. > **Note:** To view all properties for an Enhanced Dynamic Network Zone, select `DYNAMIC_V2` from the `type` dropdown list.; NetworkZone
Create a custom token claim: Creates a custom token Claim for a custom authorization server; AuthorizationServerClaims
Create an OAuth 2.0 client secret: Creates an OAuth 2.0 client secret object with a new active client secret. You can create up to two secret objects. An error is returned if you attempt to create more than two secret objects. > **Note:** This API lets you bring your own secret. If [token_endpoint_auth_method](/openapi/okta-oauth/oauth/client/createclient#client/createclient/t=request&path=token_endpoint_auth_method) of the app is `client_secret_jwt`, then the minimum length of `client_secret` is 32 characters. If no secret is specified in the request, Okta adds a new system-generated secret.; ApplicationSSOPublicKeys
Create a custom token scope: Creates a custom token scope; AuthorizationServerScopes
Create an Okta managed user account: Creates a new Okta managed user account for managing a Universal Directory user as a service account. You must specify an existing Okta user in your org with the `oktaUserId` request parameter.; OktaManagedUserAccount
Create a policy: Creates a policy. There are many types of policies that you can create. See [Policies](https://developer.okta.com/docs/concepts/policies/) for an overview of the types of policies available and links to more indepth information.; Policy
Create a policy rule: Creates a policy rule > **Note:** You can't create additional rules for the `PROFILE_ENROLLMENT`, `POST_AUTH_SESSION`, `CLIENT_UPDATE`, or <x-lifecycle class="ea"></x-lifecycle> `IDENTITY_CLAIM_SOURCING` policies.; Policy
Create a policy simulation: Creates a policy or policy rule simulation. The access simulation evaluates policy and policy rules based on the existing policy rule configuration. The evaluation result simulates what the real-world authentication flow is and what policy rules have been applied or matched to the authentication flow.; Policy
Create a principal rate limit: Creates a new principal rate limit entity. Okta only allows one principal rate limit entity per org and principal.; PrincipalRateLimit
Create a push provider: Creates a new push provider. Each Push Provider must have a unique `name`.; PushProvider
Create a realm: Creates a new realm; Realm
Create a realm assignment: Creates a new realm assignment; RealmAssignment
Create a resource set: Creates a new resource set. See [Supported resources](/openapi/okta-management/guides/roles/#supported-resources). > **Note:** The maximum number of `resources` allowed in a resource set object is 1000. Resources are identified by either an Okta Resource Name (ORN) or by a REST URL format. See [Okta Resource Name](/openapi/okta-management/guides/roles/#okta-resource-name-orn).; RoleCResourceSet
Create a role resource set binding: Creates a binding for the resource set, custom role, and members (users or groups) > **Note:** If you use a custom role with permissions that don't apply to the resources in the resource set, it doesn't affect the admin role. For example, the `okta.users.userprofile.manage` permission gives the admin no privileges if it's granted to a resource set that only includes `https://{yourOktaDomain}/api/v1/groups/{targetGroupId}` resources. If you want the admin to be able to manage the users within the group, the resource set must include the corresponding `https://{yourOktaDomain}/api/v1/groups/{targetGroupId}/users` resource.; RoleDResourceSetBinding
Create a custom role: Creates a custom role; RoleECustom
Create a custom role permission: Creates a permission (specified by `permissionType`) for a custom role; RoleECustomPermission
Create a security events provider: Creates a security events provider instance; SSFReceiver
Create an SMS template: Creates a new custom SMS template; Template
Create an SSF stream: Creates an SSF stream for an event receiver to start receiving security events in the form of Security Event Tokens (SETs) from Okta. An SSF stream is associated with the client ID of the OAuth 2.0 access token used to create the stream. The client ID is provided by Okta for an [OAuth 2.0 app integration](https://help.okta.com/okta_help.htm?id=ext_Apps_App_Integration_Wizard-oidc). One SSF stream is allowed for each client ID, hence, one SSF stream is allowed for each app integration in Okta. You can create a maximum of 10 SSF stream configurations for one org.; SSFTransmitter
Create an auto-activated TAC authenticator enrollment: Creates an auto-activated Temporary access code (TAC) authenticator enrollment; UserAuthenticatorEnrollments
Create a trusted origin: Creates a trusted origin; TrustedOrigin
Create a UI schema: Creates an input for an enrollment form; UISchema
Create a user: Creates a new user in your Okta org with or without credentials. > **Legal Disclaimer** > > After a user is added to the Okta directory, they receive an activation email. As part of signing up for this service, > you agreed not to use Okta's service/product to spam and/or send unsolicited messages. > Please refrain from adding unrelated accounts to the directory as Okta is not responsible for, and disclaims any and all > liability associated with, the activation email's content. You, and you alone, bear responsibility for the emails sent to any recipients. All responses return the created user. Activation of a user is an asynchronous operation. The system performs group reconciliation during activation and assigns the user to all apps via direct or indirect relationships (group memberships). * The user's `transitioningToStatus` property is `ACTIVE` during activation to indicate that the user hasn't completed the asynchronous operation. * The user's `status` is `ACTIVE` when the activation process is complete. The user is emailed a one-time activation token if activated without a password. > **Note:** If the user is assigned to an app that is configured for provisioning, the activation process triggers downstream provisioning to the app. It is possible for a user to sign in before these apps have been successfully provisioned for the user. > **Important:** Do not generate or send a one-time activation token when activating users with an assigned password. Users should sign in with their assigned password. For more information about the various scenarios of creating a user listed in the examples, see the [User creation scenarios](/openapi/okta-management/management/tags/user/section/user-status#section/User-creation-scenarios) section.; User
Create a user type: Creates a new user type. Okta automatically creates a `default` user type for your org. You may add up to nine additional user types. > **Note**: New user types are based on the current default schema template. Modifications to this schema do not automatically propagate to previously created user types.; UserType
Deactivate an agent pool update: Deactivates scheduled agent pool update; AgentPools
Deactivate an API service integration instance secret: Deactivates an API Service Integration instance Secret by `secretId`; ApiServiceIntegrations
Deactivate an application: Deactivates an active application > **Note:** Deactivating an app triggers a full reconciliation of all users assigned to the app by groups. This reconcile process removes the app assignment for the deactivated app, and might also correct assignments that were supposed to be removed but failed previously.; Application
Deactivate an authenticator: Deactivates an authenticator by `authenticatorId`; Authenticator
Deactivate an authenticator method: Deactivates a method for an authenticator identified by `authenticatorId` and `methodType`; Authenticator
Deactivate an authorization server: Deactivates an authorization server; AuthorizationServer
Deactivate a policy: Deactivates an authorization server policy; AuthorizationServerPolicies
Deactivate a policy rule: Deactivates an authorization server policy rule; AuthorizationServerRules
Deactivate a behavior detection rule: Deactivates a behavior detection rule; Behavior
Deactivate a custom telephony provider: Deactivates a custom telephony provider by its ID. Keep the following points in mind when you deactivate a provider: * You must deactivate a provider before deleting it. * If you have two telephony providers configured, and both are active, you can only deactivate the secondary provider. The second provider is the one that isn't set as the primary provider.; CustomTelephonyProvider
Deactivate the default provisioning connection: Deactivates the default provisioning connection for an app; ApplicationConnections
Deactivate a device: Deactivates a device by setting its status to `DEACTIVATED` by `deviceId`. Deactivation causes a device to lose all device user links. Set the device status to `DEACTIVATED` before deleting it. > **Note:** When deactivating a Device, keep in mind the following: - Device deactivation is a destructive operation for device factors and client certificates. Device reenrollment using Okta Verify allows end users to set up new factors on the device. - Device deletion removes the device record from Okta. Reenrollment creates a new device record.; Device
Deactivate a device integration: Deactivates a device integration by `deviceIntegrationId`; DeviceIntegrations
Deactivate an event hook: Deactivates the event hook that matches the provided `id`; EventHook
Deactivate a group rule: Deactivates a specific group rule by ID from your org; GroupRule
Deactivate an IdP: Deactivates an active identity provider (IdP); IdentityProvider
Deactivate an inline hook: Deactivates the inline hook by `inlineHookId`; InlineHook
Deactivate a log stream: Deactivates a log stream by `logStreamId`; LogStream
Deactivate a network zone: Deactivates a Network Zone by `zoneId`; NetworkZone
Deactivate an OAuth 2.0 client JSON Web Key: Deactivates an OAuth 2.0 client JSON Web Key by `keyId` > **Note:** You can only deactivate signing keys. Deactivating the active encryption key isn't allowed if the client has ID token encryption enabled. You can activate another encryption key, which makes the current key inactive.; ApplicationSSOPublicKeys
Deactivate an OAuth 2.0 client secret: Deactivates an OAuth 2.0 client secret by `secretId`. You can't deactivate a secret if it's the only secret of the client.; ApplicationSSOPublicKeys
Deactivate a Custom Authorization Server Public JSON Web Key: Deactivates a custom authorization server public JSON web key by key `id`. > **Note:** Deactivating the active key isn't allowed if the authorization server has access token encryption enabled. You can activate another key, which makes the current key inactive.; OAuth2ResourceServerCredentialsKeys
Deactivate a policy: Deactivates a policy; Policy
Deactivate a policy rule: Deactivates a policy rule identified by `policyId` and `ruleId`; Policy
Deactivate a realm assignment: Deactivates a realm assignment; RealmAssignment
Deactivate a security events provider: Deactivates a security events provider instance by setting its status to `INACTIVE`. This operation stops the flow of events from the security events provider to Okta.; SSFReceiver
Deactivate a trusted origin: Deactivates a trusted origin. Sets the `status` to `INACTIVE`.; TrustedOrigin
Deactivate a user: Deactivates a user. Perform this operation only on users that do not have a `DEPROVISIONED` status. * The user's `transitioningToStatus` property is `DEPROVISIONED` during deactivation to indicate that the user hasn't completed the asynchronous operation. * The user's status is `DEPROVISIONED` when the deactivation process is complete. > **Important:** Deactivating a user is a **destructive** operation. The user is deprovisioned from all assigned apps, which might destroy their data such as email or files. **This action cannot be recovered!** You can also perform user deactivation asynchronously. To invoke asynchronous user deactivation, pass an HTTP header `Prefer: respond-async` with the request. > **Note:** Users with the `DEPROVISIONED` status won't have their profiles updated when running the [Update a user](/openapi/okta-management/management/user/updateuser) endpoint unless you have the **Edit Deactived User Profile Updates** option turned on in the Admin Console. See [Edit deactivated user profiles](https://help.okta.com/okta_help.htm?type=oie&id=edit-deactivated-users).; UserLifecycle
Delete an agent pool update: Deletes agent pool update; AgentPools
Delete all email customizations: Deletes all customizations for an email template <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is enabled, all customizations are deleted, including customizations for additional languages. If disabled, only customizations in Okta-supported languages are deleted.; CustomTemplates
Delete an API service integration instance: Deletes an API Service Integration instance by `id`. This operation also revokes access to scopes that were previously granted to this API Service Integration instance.; ApiServiceIntegrations
Delete an API service integration instance secret: Deletes an API Service Integration instance Secret by `secretId`. You can only delete an inactive Secret.; ApiServiceIntegrations
Delete an app service account: Deletes an app service account specified by ID; ServiceAccount
Delete an application: Deletes an inactive application; Application
Delete an associated authorization server: Deletes an associated Authorization Server; AuthorizationServerAssoc
Delete an authenticator enrollment: Deletes an existing enrollment for the specified user. The user can enroll the authenticator again.; UserAuthenticatorEnrollments
Delete an authorization server: Deletes an authorization server; AuthorizationServer
Delete a policy: Deletes a policy; AuthorizationServerPolicies
Delete a policy rule: Deletes a Policy Rule defined in the specified Custom Authorization Server and Policy; AuthorizationServerRules
Delete a behavior detection rule: Deletes a Behavior Detection Rule by `behaviorId`; Behavior
Delete a role resource set binding: Deletes a binding of a role (identified by `roleIdOrLabel`) and a resource set (identified by `resourceSetIdOrLabel`); RoleDResourceSetBinding
Delete a brand: Deletes a brand by `brandId`; Brands
Delete the background image: Deletes a theme background image; Themes
Delete the favicon: Deletes a theme favicon. The theme will use the default Okta favicon.; Themes
Delete the logo: Deletes a Theme logo. The theme will use the default Okta logo.; Themes
Delete a CAPTCHA instance: Deletes a specified CAPTCHA instance > **Note:** If your CAPTCHA instance is still associated with your org, the request fails. You must first update your Org-wide CAPTCHA settings to remove the CAPTCHA instance.; CAPTCHA
Delete a Cross App Access connection: Deletes a Cross App Access connection with the specified ID; ApplicationCrossAppAccessConnections
Delete a custom AAGUID: Deletes a custom AAGUID You can only delete custom AAGUIDs that an admin has created.; Authenticator
Delete a custom domain: Deletes a custom domain by `domainId`; CustomDomain
Delete a custom telephony provider: Deletes a custom telephony provider by its ID. Before you delete a provider, ensure that it is [deactivated](/openapi/okta-management/management/customtelephonyprovider/deactivatecustomtelephonycredential). Consider setting up another telephony provider if you still plan to use telephony in your org. See [Set up an external telephony provider](https://help.okta.com/okta_help.htm?type=oie&id=about-telephony).; CustomTelephonyProvider
Delete the customized error page: Deletes the customized error page. As a result, the default error page appears in your live environment.; CustomPages
Delete the customized sign-in page: Deletes the customized sign-in page. As a result, the default sign-in page appears in your live environment.; CustomPages
Delete a device: Deletes (permanently) a device by `deviceId` if it has a status of `DEACTIVATED`. You can transition the device to `DEACTIVATED` status using the [Deactivate a Device](/openapi/okta-management/management/tags/device/other/deactivatedevice) endpoint. This request is destructive and deletes all of the profile data related to the device. Once deleted, device data can't be recovered. However, reenrollment creates a new device record. > **Note:** Attempts to delete a device that isn't in a `DEACTIVATED` state raise an error.; Device
Delete a device assurance policy: Deletes a device assurance policy by `deviceAssuranceId`. If the device assurance policy is currently being used in the org Authentication Policies, the delete will not be allowed.; DeviceAssurance
Delete a device posture check: Deletes a device posture check by `postureCheckId`. You can't delete the device posture check if it's used in a device assurance policy.; DevicePostureCheck
Delete an email customization: Deletes an Email Customization by its unique identifier <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is disabled, deletion of an existing additional language customization by ID doesn't register.; CustomTemplates
Delete an email domain: Deletes an Email Domain by `emailDomainId`; EmailDomain
Delete an SMTP server configuration: Deletes the specified custom SMTP server configuration; EmailServer
Delete an event hook: Deletes the event hook that matches the provided `id`. After deletion, the event hook is unrecoverable. As a safety precaution, you can only delete event hooks with a status of `INACTIVE`.; EventHook
Delete a federated claim: Deletes a federated claim by `claimId`; ApplicationSSOFederatedClaims
Delete a governance bundle: Deletes an Admin Console governance bundle; GovernanceBundle
Delete a group: Deletes a group of the `OKTA_GROUP` or `APP_GROUP` type from your org. > **Note:** You can't remove groups of type `APP_GROUP` if they are used in a group push mapping.; Group
Delete a group owner: Deletes a group owner from a specific group; GroupOwner
Delete a group push mapping: Deletes a specific group push mapping. The group push mapping must be in an `INACTIVE` state.; GroupPushMapping
Delete a group rule: Deletes a specific group rule by `groupRuleId`; GroupRule
Delete a key: Deletes a key by `id`. After being deleted, the key is unrecoverable. As a safety precaution, only keys that aren't being used are eligible for deletion.; HookKey
Delete an IdP: Deletes an identity provider (IdP) integration by `idpId` * All existing IdP users are unlinked with the highest order profile source taking precedence for each IdP user. * Unlinked users keep their existing authentication provider such as `FEDERATION` or `SOCIAL`.; IdentityProvider
Delete an IdP key credential: Deletes a specific identity provider (IdP) key credential by `kid` if it isn't currently being used by an active or inactive IdP; IdentityProviderKeys
Delete an identity source group: Deletes a group in an identity source for a given identity source ID and group ID; IdentitySource
Delete the memberships for the specified identity source group: Deletes group memberships for the specified identity source group using member external IDs; IdentitySource
Delete an identity source session: Deletes an identity source session for a given identity source ID and session Id; IdentitySource
Delete an identity source user: Deletes a user in an identity source for the given identity source instance and external ID; IdentitySource
Delete an inline hook: Deletes an inline hook by `inlineHookId`. After it's deleted, the inline hook is unrecoverable. As a safety precaution, only inline hooks with a status of `INACTIVE` are eligible for deletion.; InlineHook
Delete an interclient trust mapping: Deletes the mapping between the target app and an allowed app; ApplicationInterclientTrustMappings
Delete a linked object definition: Deletes the Linked Object definition specified by either the `primary` or `associated` name. The entire definition is removed, regardless of which name that you specify.; LinkedObject
Delete a linked object value: Deletes any existing relationship between the `associated` and `primary` user. For the `associated` user, this is specified by the ID. The `primary` name specifies the relationship. The operation is successful if the relationship is deleted. The operation is also successful if the specified user isn't in the `associated` relationship for any instance of the specified `primary` and thus, no relationship is found.; UserLinkedObject
Delete a log stream: Deletes a log stream object from your org by ID; LogStream
Delete a network zone: Deletes a Network Zone by `zoneId` > **Notes:** > * You can't delete a Network Zone that's used by a [Policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/) or [Rule](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/#tag/Policy/operation/listPolicyRules). > * For Okta Identity Engine orgs, you can't delete a Network Zone with an ACTIVE `status`. <x-lifecycle class="oie"></x-lifecycle>; NetworkZone
Delete a custom token claim: Deletes a custom token Claim specified by the `claimId`; AuthorizationServerClaims
Delete an OAuth 2.0 client secret: Deletes an OAuth 2.0 client secret by `secretId`. You can only delete an inactive secret.; ApplicationSSOPublicKeys
Delete a Custom Authorization Server Public JSON Web Key: Deletes a custom authorization server public JSON web key by key `id`. You can only delete an inactive key.; OAuth2ResourceServerCredentialsKeys
Delete a custom token scope: Deletes a custom token scope; AuthorizationServerScopes
Delete an Okta managed user account: Deletes an Okta managed user account specified by ID. This operation removes the service account management for the Okta user, suspends the underlying Okta user account, but doesn't delete the user from Universal Directory.; OktaManagedUserAccount
Delete the org-wide CAPTCHA settings: Deletes the CAPTCHA settings object for your organization; CAPTCHA
Delete a policy: Deletes a policy; Policy
Delete a policy resource mapping: Deletes the resource mapping for a policy identified by `policyId` and `mappingId`; Policy
Delete a policy rule: Deletes a policy rule identified by `policyId` and `ruleId`; Policy
Delete the preview error page: Deletes the preview error page. The preview error page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/error/preview`.; CustomPages
Delete the preview sign-in page: Deletes the preview sign-in page. The preview sign-in page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/login/preview`.; CustomPages
Delete a push provider: Deletes a push provider by `pushProviderId`. If the push provider is currently being used in the org by a custom authenticator, the delete will not be allowed.; PushProvider
Delete a realm: Deletes a realm permanently. This operation can only be performed after disassociating other entities like users and identity providers from a realm.; Realm
Delete a realm assignment: Deletes a realm assignment; RealmAssignment
Delete a resource set: Deletes a resource set by `resourceSetIdOrLabel`; RoleCResourceSet
Delete a resource set resource: Deletes a resource (identified by `resourceId`) from a resource set; RoleCResourceSetResource
Delete a custom role: Deletes a custom role by `roleIdOrLabel`; RoleECustom
Unassign a client role: Unassigns a role assignment (identified by `roleAssignmentId`) from a client app (identified by `clientId`); RoleAssignmentClient
Delete a custom role permission: Deletes a permission (identified by `permissionType`) from a custom role; RoleECustomPermission
Delete a security events provider: Deletes a security events provider instance specified by `id`; SSFReceiver
Delete an SMS template: Deletes an SMS template; Template
Delete an SSF stream: Deletes the specified SSF stream. If the `stream_id` is not provided in the query string, the associated stream with the client ID (through the request OAuth 2.0 access token) is deleted. Otherwise, the SSF stream with the `stream_id` is deleted, if found.; SSFTransmitter
Delete a trusted origin: Deletes a trusted origin; TrustedOrigin
Delete a UI schema: Deletes a UI Schema by `id`; UISchema
Delete a user: Deletes a user permanently. This operation can only be performed on users that have a `DEPROVISIONED` status. > **Warning:** This action can't be recovered! This operation on a user that hasn't been deactivated causes that user to be deactivated. A second delete operation is required to delete the user. > **Note:** You can also perform user deletion asynchronously. To invoke asynchronous user deletion, pass an HTTP header `Prefer: respond-async` with the request. This header is also supported by user deactivation, which is performed if the delete endpoint is invoked on a user that hasn't been deactivated.; User
Delete a user type: Deletes a user type permanently. > **Note**: You can't delete the default user type or a user type that is currently assigned to users.; UserType
Delete a WebAuthn preregistration factor: Deletes a specific WebAuthn preregistration factor for a user; WebAuthnPreregistration
Delete an OAuth 2.0 client JSON Web Key: Deletes an OAuth 2.0 Client JSON Web Key by `keyId`. You can only delete an inactive key.; ApplicationSSOPublicKeys
Enroll a factor: Enrolls a supported factor for the specified user > **Notes:** > * All responses return the enrolled factor with a status of either `PENDING_ACTIVATION` or `ACTIVE`. > * You can't use the Factors API to enroll Okta FastPass (`signed_nonce`) for a user. See [Configure Okta FastPass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). #### Additional SMS/Call factor information * **Rate limits**: Okta may return a `429 Too Many Requests` status code if you attempt to resend an SMS or a voice call challenge (OTP) within the same time window. The current [rate limit](https://developer.okta.com/docs/reference/rate-limits/) is one SMS/CALL challenge per phone number every 30 seconds. * **Existing phone numbers**: Okta may return a `400 Bad Request` status code if a user attempts to enroll with a different phone number when the user has an existing mobile phone or has an existing phone with voice call capability. A user can enroll only one mobile phone for `sms` and enroll only one voice call capable phone for `call` factor. #### Additional WebAuthn factor information * For detailed information on the WebAuthn standard, including an up-to-date list of supported browsers, see [webauthn.me](https://a0.to/webauthnme-okta-docs). * When you enroll a WebAuthn factor, the `activation` object in `_embedded` contains properties used to help the client to create a new WebAuthn credential for use with Okta. See the [WebAuthn spec for PublicKeyCredentialCreationOptions](https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions). * As of the `2026.04.0` release, the FIDO2 (WebAuthn) authenticator is now called Passkey (FIDO2 WebAuthn) and there are new settings and updates to the authenticator page layout. There have been no changes to any existing parameter names, values, or endpoint paths. For example, the `factorType` for the Passkey (FIDO2 WebAuthn) authenticator is still `webauthn`. See [Passkeys and WebAuthn](https://developer.okta.com/docs/guides/authenticators-web-authn/aspnet/main/#passkeys-and-webauthn). #### Additional Custom TOTP factor information * The enrollment process involves passing both the `factorProfileId` and `sharedSecret` properties for a token. * A factor profile represents a particular configuration of the Custom TOTP factor. It includes certain properties that match the hardware token that end users possess, such as the HMAC algorithm, passcode length, and time interval. There can be multiple Custom TOTP factor profiles per org, but users can only enroll in one Custom TOTP factor. Admins can [create Custom TOTP factor profiles](https://help.okta.com/okta_help.htm?id=ext-mfa-totp) in the Admin Console. Then, copy the `factorProfileId` from the Admin Console into the API request. * <x-lifecycle class="oie"></x-lifecycle> For Custom TOTP enrollment, Okta automaticaly enrolls a user with a `token:software:totp` factor and the `push` factor if the user isn't currently enrolled with these factors.; UserFactor
Enroll a preregistered WebAuthn factor: Enrolls a preregistered WebAuthn factor. This WebAuthn factor has a longer challenge timeout period to accommodate the fulfillment request process. As part of this operation, Okta generates elliptic curve (EC) key-pairs used to encrypt the factor PIN and enrollment data sent by the fulfillment provider.; WebAuthnPreregistration
Execute an inline hook: Executes the inline hook that matches the provided `inlineHookId` by using the request body as the input. This inline hook sends the provided data through the `channel` object and returns a response if it matches the correct data contract. Otherwise it returns an error. You need to construct a JSON payload that matches the payloads that Okta would send to your external service for this inline hook type. A timeout of three seconds is enforced on all outbound requests, with one retry in the event of a timeout or an error response from the remote system. If a successful response isn't received after the request, a 400 error is returned with more information about what failed. >**Note:** This execution endpoint isn't tied to any other functionality in Okta, and you should only use it for testing purposes.; InlineHook
Execute a realm assignment: Executes a realm assignment; RealmAssignment
Expire the password: Expires the password. This operation transitions the user status to `PASSWORD_EXPIRED` so that the user must change their password the next time that they sign in. If you have integrated Okta with your on-premises Active Directory (AD), then setting a user's password as expired in Okta also expires the password in AD. When the user tries to sign in to Okta, delegated authentication finds the password-expired status in AD, and the user is presented with the password-expired page where they can change their password. > **Note:** The Okta account management policy doesn't support the `/users/{id}/lifecycle/expire_password` endpoint. See [Configure an Okta account management policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/).; UserCred
Expire the password with a temporary password: Expires the password and resets the user's password to a temporary password. This operation transitions the user status to `PASSWORD_EXPIRED` so that the user must change their password the next time that they sign in. The user's password is reset to a temporary password that's returned, and then the user's password is expired. If `revokeSessions` is included in the request with a value of `true`, the user's current outstanding sessions are revoked and require re-authentication. If you have integrated Okta with your on-premises Active Directory (AD), then setting a user's password as expired in Okta also expires the password in AD. When the user tries to sign in to Okta, delegated authentication finds the password-expired status in AD, and the user is presented with the password-expired page where they can change their password.; UserCred
Extend Okta Support access: Extends the length of time that Okta Support can access your org by 24 hours. This means that 24 hours are added to the remaining access time. > **Note:** This resource is deprecated. Use the [Update an Okta Support case](/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) resource to extend Okta Support access for a support case. > For the corresponding Okta Admin Console feature, see [Give access to Okta Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access).; OrgSettingSupport
Start forgot password flow: Starts the forgot password flow. Generates a one-time token (OTT) that you can use to reset a user's password. The user must validate their security question's answer when visiting the reset link. Perform this operation only on users with an `ACTIVE` status and a valid [recovery question credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/recovery_question&t=request). > **Note:** If you have migrated to Identity Engine, you can allow users to recover passwords with any enrolled MFA authenticator. See [Self-service account recovery](https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-sspr.htm?cshid=ext-config-sspr). If an email address is associated with multiple users, keep in mind the following to ensure a successful password recovery lookup: * Okta no longer includes deactivated users in the lookup. * The lookup searches sign-in IDs first, then primary email addresses, and then secondary email addresses. If `sendEmail` is `false`, returns a link for the user to reset their password. This operation doesn't affect the status of the user.; UserCred
Reset password with recovery question: Resets the user's password to the specified password if the provided answer to the recovery question is correct. You must include the recovery question answer with the submission.; UserCred
Generate a key credential: Generates a new X.509 certificate for an app key credential > **Note:** To update an app with the newly generated key credential, use the [Replace an Application](/openapi/okta-management/management/application/replaceapplication) request with the new [credentials.signing.kid](/openapi/okta-management/management/application/replaceapplication#application/replaceapplication/t=request&path=&d=0/credentials/signing/kid) value in the request body. You can provide just the [signing credential object](/openapi/okta-management/management/application/replaceapplication#application/replaceapplication/t=request&path=&d=0/credentials/signing) instead of the entire [application credential object](/openapi/okta-management/management/application/replaceapplication#application/replaceapplication/t=response&c=200&path=&d=0/credentials).; ApplicationSSOCredentialKey
Generate a certificate signing request: Generates a new key pair and returns the certificate signing request (CSR) for it. The information in a CSR is used by the Certificate Authority (CA) to verify and create your certificate. It also contains the public key that's included in your certificate. Returns CSR in `pkcs#10` format if the `Accept` media type is `application/pkcs10` or a CSR object if the `Accept` media type is `application/json`. > **Note:** The key pair isn't listed in the key credentials for the app until it's published.; ApplicationSSOCredentialKey
Generate a certificate signing request: Generates a new key pair and returns a certificate signing request (CSR) for it > **Note:** The private key isn't listed in the [signing key credentials for the identity provider (IdP)](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderSigningKeys/#tag/IdentityProviderSigningKeys/operation/listIdentityProviderSigningKeys) until it's published.; IdentityProviderSigningKeys
Generate a fulfillment request: Generates a fulfillment request by sending a WebAuthn preregistration event to start the flow. The WebAuthn preregistration integration for Okta Workflows uses a preregistration event to populate the fulfillment request.; WebAuthnPreregistration
Generate a new signing key credential for IdP: Generates a new X.509 certificate for an identity provider (IdP) signing key credential to be used for signing assertions sent to the IdP. IdP signing keys are read-only. > **Note:** To update an IdP with the newly generated key credential, [update your IdP](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider) using the returned key's `kid` in the [signing credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/credentials/signing/kid&t=request).; IdentityProviderSigningKeys
Retrieve Okta Aerial consent for your org: Retrieves the Okta Aerial consent grant details for your Org. Returns a 404 Not Found error if no consent has been granted.; OrgSettingSupport
Retrieve an agent pool update by ID: Retrieves an agent pool update by its `updateId`; AgentPools
Retrieve an agent pool update's settings: Retrieves the current state of the agent pool update instance settings; AgentPools
Retrieve all Cross App Access connections: Retrieves inbound and outbound Cross App Access connections associated with an app; ApplicationCrossAppAccessConnections
Retrieve all the well-known URIs: Retrieves the content from each of the well-known URIs for a specified brand; AssociatedDomainCustomizations
Retrieve an API service integration instance: Retrieves an API Service Integration instance by `id`; ApiServiceIntegrations
Retrieve an API token's metadata: Retrieves the metadata for an active API token by `apiTokenId`; ApiToken
Retrieve an app service account: Retrieves an app service account specified by ID; ServiceAccount
Retrieve the customized apple-app-site-association URI content: Retrieves the content of the `apple-app-site-assocation` well-known URI > **Note:** When serving this URI, Okta adds `authsrv` content to provide a seamless experience for Okta Verify. You can't modify the content in the `authsrv` object.; AssociatedDomainCustomizations
Retrieve an application: Retrieves an application from your Okta organization by `id`; Application
Retrieve an application group: Retrieves an app group assignment; ApplicationGroups
Retrieve a key credential: Retrieves a specific application key credential by `kid`; ApplicationSSOCredentialKey
Retrieve an application user: Retrieves a specific user assignment for a specific app; ApplicationUsers
Retrieve the default app user schema for an app: Retrieves the default schema for an app user. The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to apps. All users assigned to a given app use the same app user schema. Therefore, unlike the user schema operations, the app user schema operations all specify `default` and don't accept a schema ID.; Schema
Retrieve the customized assetlinks.json URI content: Retrieves the content of the `assetlinks.json` well-known URI; AssociatedDomainCustomizations
Retrieve an authenticator: Retrieves an authenticator from your Okta organization by `authenticatorId`; Authenticator
Retrieve an authenticator enrollment: Retrieves a user's authenticator enrollment by `enrollmentId`; UserAuthenticatorEnrollments
Retrieve an authenticator method: Retrieves a method identified by `methodType` of an authenticator identified by `authenticatorId`; Authenticator
Retrieve the authenticator settings: Retrieves the Authenticator Settings for an org; AttackProtection
Retrieve an authorization server: Retrieves an authorization server; AuthorizationServer
Retrieve an authorization server key: Retrieves an Authorization Server Key specified by the `keyId`; AuthorizationServerKeys
Retrieve a policy: Retrieves a policy; AuthorizationServerPolicies
Retrieve a policy rule: Retrieves a policy rule by `ruleId`; AuthorizationServerRules
Retrieve the Okta Admin Console assignment setting: Retrieves the org setting to automatically assign the Okta Admin Console when an admin role is assigned; OrgSettingAdmin
Retrieve a behavior detection rule: Retrieves a Behavior Detection Rule by `behaviorId`; Behavior
Retrieve a role resource set binding: Retrieves the binding of a role (identified by `roleIdOrLabel`) for a resource set (identified by `resourceSetIdOrLabel`); RoleDResourceSetBinding
Retrieve the bot protection configuration: Retrieves the bot protection configuration for your org; BotProtection
Retrieve a brand: Retrieves a brand by `brandId`; Brands
Retrieve a theme: Retrieves a theme for a brand; Themes
Retrieve the customized content of the specified well-known URI: Retrieves the customized content of a well-known URI for a specific brand and well-known URI path; AssociatedDomainCustomizations
Retrieve a CAPTCHA instance: Retrieves the properties of a specified CAPTCHA instance; CAPTCHA
Retrieve the default public client app role setting: Retrieves the org setting to assign the [Super Admin role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin) to new public client apps; OrgSettingAdmin
Retrieve a Cross App Access connection: Retrieves the Cross App Access connection with the specified ID; ApplicationCrossAppAccessConnections
Retrieve a certificate signing request: Retrieves a certificate signing request (CSR) for the app by `csrId`. Returns a Base64-encoded CSR in DER format if the `Accept` media type is `application/pkcs10` or a CSR object if the `Accept` media type is `application/json`.; ApplicationSSOCredentialKey
Retrieve a certificate signing request: Retrieves a specific certificate signing request (CSR) by `id`; IdentityProviderSigningKeys
Retrieve the ThreatInsight configuration: Retrieves the ThreatInsight configuration for the org; ThreatInsight
Retrieve a custom AAGUID: Retrieves a custom AAGUID; Authenticator
Retrieve a custom domain: Retrieves a custom domain by `domainId`; CustomDomain
Retrieve a custom telephony provider: Retrieves the details of a custom telephony provider by its ID; CustomTelephonyProvider
Retrieve a preview of an email customization: Retrieves a Preview of an Email Customization. All variable references are populated from the current user's context. For example, `${user.profile.firstName}`. <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is disabled, requests for the preview of an additional language customization by ID return a `404 Not Found` error response.; CustomTemplates
Retrieve the customized error page: Retrieves the customized error page. The customized error page appears in your live environment.; CustomPages
Retrieve the customized sign-in page: Retrieves the customized sign-in page. The customized sign-in page appears in your live environment.; CustomPages
Retrieve the default error page: Retrieves the default error page. The default error page appears when no customized error page exists.; CustomPages
Retrieve the default provisioning connection: Retrieves the default provisioning connection for an app; ApplicationConnections
Retrieve the default sign-in page: Retrieves the default sign-in page. The default sign-in page appears when no customized sign-in page exists.; CustomPages
Retrieve a device: Retrieves a device by `deviceId`; Device
Retrieve a device assurance policy: Retrieves a device assurance policy by `deviceAssuranceId`; DeviceAssurance
Retrieve a device integration: Retrieves a device integration by `deviceIntegrationId`; DeviceIntegrations
Retrieve an OS account: Retrieves an OS account by `osAccountId` for a device; Device
Retrieve a device posture check: Retrieves a device posture check by `postureCheckId`; DevicePostureCheck
Retrieve the disaster recovery status for all domains: Retrieves the failover or failback status for all the domains for your org; DisasterRecovery
Retrieve the disaster recovery status for a domain: Retrieves the failover or failback status for the domain specified in the request path; DisasterRecovery
Retrieve an email customization: Retrieves an email customization by its unique identifier <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is disabled, requests to retrieve an additional language customization by ID result in a `404 Not Found` error response.; CustomTemplates
Retrieve an email template default content: Retrieves an email template's default content <x-lifecycle class="ea"></x-lifecycle> Defaults to the current user's language given the following: - Custom languages for Okta Email Templates is enabled - An additional language is specified for the `language` parameter; CustomTemplates
Retrieve a preview of the email template default content: Retrieves a preview of an Email Template's default content. All variable references are populated using the current user's context. For example, `${user.profile.firstName}`. <x-lifecycle class="ea"></x-lifecycle> Defaults to the current user's language given the following: - Custom languages for Okta Email Templates is enabled - An additional language is specified for the `language` parameter; CustomTemplates
Retrieve an email domain: Retrieves an Email Domain by `emailDomainId`; EmailDomain
Retrieve an SMTP server configuration: Retrieves the specified custom SMTP server configuration; EmailServer
Retrieve the email template settings: Retrieves an email template's settings; CustomTemplates
Retrieve an email template: Retrieves the details of an email template by name; CustomTemplates
Retrieve the error page sub-resources: Retrieves the error page sub-resources. The `expand` query parameter specifies which sub-resources to include in the response.; CustomPages
Retrieve an event hook: Retrieves an event hook; EventHook
Retrieve a factor: Retrieves an existing factor for the specified user; UserFactor
Retrieve a factor transaction status: Retrieves the status of a `push` factor verification transaction > **Note:** > The response body for a number matching push challenge to an Okta Verify `push` factor enrollment is different from the response body of a standard push challenge. > The number matching push challenge [response body](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userfactor/other/getfactortransactionstatus!c=200&path=1/_embedded&t=response) contains the correct answer for the challenge. > Use [Verify a factor](/openapi/okta-management/management/userfactor/verifyfactor) to configure which challenge is sent.; UserFactor
Retrieve a feature: Retrieves a feature by ID; Feature
Retrieve a feature: Retrieves a Feature object for an app; ApplicationFeatures
Retrieve a federated claim: Retrieves a federated claim by `claimId`; ApplicationSSOFederatedClaims
Retrieve the Okta application settings: Retrieves the settings for an Okta app (also known as an Okta first-party app); OktaApplicationSettings
Retrieve a governance bundle: Retrieves a governance bundle for the Admin Console; GovernanceBundle
Retrieve a group: Retrieves a specific group by `id` from your org; Group
Retrieve a group role assignment: Retrieves a role assigned to a group (identified by the `groupId`). The `roleAssignmentId` is the unique identifier for either a standard role group assignment object or a custom role resource set binding object.; RoleAssignmentBGroup
Retrieve the results of an AD group query: Retrieves the results of the requested Active Directory (AD) group attributes using the `resultId` returned from the `POST /api/v1/directories/{appInstanceId}/groups/{groupId}/query` call. If the operation has expired or if the `resultId` is invalid, returns a `404` status.; DirectoriesIntegration
Retrieve a group push mapping: Retrieves a group push mapping by ID; GroupPushMapping
Retrieve a group rule: Retrieves a specific group rule by ID from your org; GroupRule
Retrieve the default group schema: Retrieves the group schema The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to groups. All groups use the same group schema. Unlike user schema operations, group schema operations all specify `default` and don't accept a schema ID.; Schema
Retrieve a key by ID: Retrieves the public portion of the Key object using the `id` parameter >**Note:** The `?expand=publickey` query parameter optionally returns the full object including the details of the public key in the response body's `_embedded` property.; HookKey
Retrieve an IdP: Retrieves an identity provider (IdP) integration by `idpId`; IdentityProvider
Retrieve a user for IdP: Retrieves a linked identity provider (IdP) user by ID; IdentityProviderUsers
Retrieve an IdP key credential: Retrieves a specific identity provider (IdP) key credential by `kid`; IdentityProviderKeys
Retrieve a signing key credential for IdP: Retrieves a specific identity provider (IdP) key credential by `kid`; IdentityProviderSigningKeys
Retrieve an identity source group: Retrieves a group from an identity source for a given identity source ID and group ID or external ID; IdentitySource
Retrieve the memberships for the given identity source group: Retrieves the group memberships for the given identity source group in the given identity source instance; IdentitySource
Retrieve an identity source session: Retrieves an identity source session for a given identity source ID and session ID; IdentitySource
Retrieve an identity source user: Retrieves a user by external ID in an identity source for the given identity source instance; IdentitySource
Retrieve an inline hook: Retrieves an inline hook by `inlineHookId`; InlineHook
Retrieve an OAuth 2.0 client JSON Web Key: Retrieves an OAuth 2.0 client JSON Web Key by `keyId`; ApplicationSSOPublicKeys
Retrieve a linked object definition: Retrieves a Linked Object definition; LinkedObject
Retrieve a log stream: Retrieves a log stream object by ID; LogStream
Retrieve the log stream schema for the schema type: Retrieves the schema for a log stream type. The `logStreamType` element in the URL specifies the log stream type, which is either `aws_eventbridge` or `splunk_cloud_logstreaming`. Use the `aws_eventbridge` literal to retrieve the AWS EventBridge type schema, and use the `splunk_cloud_logstreaming` literal retrieve the Splunk Cloud type schema.; Schema
Retrieve a role resource set binding member: Retrieves a member (identified by `memberId`) that belongs to a role resource set binding; RoleDResourceSetBindingMember
Retrieve a network zone: Retrieves a Network Zone by `zoneId`; NetworkZone
Retrieve a custom token claim: Retrieves a custom token Claim by the specified `claimId`; AuthorizationServerClaims
Retrieve an OAuth 2.0 client secret: Retrieves an OAuth 2.0 client secrets by `secretId`; ApplicationSSOPublicKeys
Retrieve a Custom Authorization Server Public JSON Web Key: Retrieves a custom authorization server public JSON web key by key `id`; OAuth2ResourceServerCredentialsKeys
Retrieve a custom token scope: Retrieves a custom token scope; AuthorizationServerScopes
Retrieve an application token: Retrieves a refresh token for the specified app; ApplicationTokens
Retrieve the Okta communication settings: Retrieves Okta Communication Settings of your org; OrgSettingCommunication
Retrieve an Okta managed user account: Retrieves an Okta managed user account specified by ID; OktaManagedUserAccount
Retrieve the Admin Console opt-in status: Retrieves the entitlement management opt-in status for the Admin Console; GovernanceBundle
Retrieve the org-wide CAPTCHA settings: Retrieves the CAPTCHA settings object for your organization > **Note**: If the current organization hasn't configured CAPTCHA Settings, the request returns an empty object.; CAPTCHA
Retrieve the contact type user: Retrieves the ID and the user resource associated with the specified contact type; OrgSettingContact
Retrieve the Okta Support settings: Retrieves Okta Support Settings for your org; OrgSettingSupport
Retrieve the org preferences: Retrieves preferences of your Okta org; OrgSettingCustomization
Retrieve the Org general settings: Retrieves the Org General Settings; OrgSettingGeneral
Retrieve a policy: Retrieves a policy; Policy
Retrieve a policy resource mapping: Retrieves a resource mapping for a policy identified by `policyId` and `mappingId`; Policy
Retrieve a policy rule: Retrieves a policy rule; Policy
Retrieve the preview error page preview: Retrieves the preview error page. The preview error page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/error/preview`.; CustomPages
Retrieve the preview sign-in page preview: Retrieves the preview sign-in page. The preview sign-in page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/login/preview`.; CustomPages
Retrieve a principal rate limit: Retrieves a principal rate limit entity by `principalRateLimitId`; PrincipalRateLimit
Retrieve a profile mapping: Retrieves a single profile mapping referenced by its ID; ProfileMapping
Retrieve a public key: Retrieves a public key by `keyId` >**Note:** keyId is the alias of the public key.; HookKey
Retrieve a push provider: Retrieves a push provider by `pushProviderId`; PushProvider
Retrieve the rate limit admin notification settings: Retrieves the currently configured Rate Limit Admin Notification Settings; RateLimitSettings
Retrieve the per-client rate limit settings: Retrieves the currently configured Per-Client Rate Limit Settings; RateLimitSettings
Retrieve the rate limit warning threshold percentage: Retrieves the currently configured threshold for warning notifications when the API's rate limit is exceeded; RateLimitSettings
Retrieve a realm: Retrieves a realm; Realm
Retrieve a realm assignment: Retrieves a realm assignment; RealmAssignment
Retrieve a refresh token for a client: Retrieves a refresh token for a Client; AuthorizationServerClients
Retrieve a refresh token for a client: Retrieves a refresh token issued for the specified user and client; UserOAuth
Retrieve a resource set: Retrieves a resource set by `resourceSetIdOrLabel`; RoleCResourceSet
Retrieve a resource set resource: Retrieves a resource identified by `resourceId` in a resource set; RoleCResourceSetResource
Retrieve a role: Retrieves a role by `roleIdOrLabel`; RoleECustom
Retrieve a user role governance source: Retrieves a governance source (identified by `grantId`) for a role (identified by `roleAssignmentId`) that's assigned to a user (identified by `userId`); RoleAssignmentAUser
Retrieve the user role governance source resources: Retrieves the resources of a governance source (identified by `grantId`) for a role (identified by `roleAssignmentId`) that's assigned to a user (identified by `userId`); RoleAssignmentAUser
Retrieve a custom role permission: Retrieves a permission (identified by `permissionType`) for a custom role; RoleECustomPermission
Retrieve a role target by assignment type: Retrieves all role targets for an `APP_ADMIN`, `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user by user or group assignment type. If the role isn't scoped to specific group targets or any app targets, an empty array `[]` is returned.; RoleBTargetAdmin
Retrieve the well-known URI of a specific brand: Retrieves the well-known URI of a specific brand and well-known URI path; AssociatedDomainCustomizations
Retrieve an app grant: Retrieves a single scope consent Grant object for the app; ApplicationGrants
Retrieve the security events provider: Retrieves the security events provider instance specified by `id`; SSFReceiver
Retrieve a session: Retrieves information about the session specified by the given session ID; Session
Retrieve the sign-in page sub-resources: Retrieves the sign-in page sub-resources. The `expand` query parameter specifies which sub-resources to include in the response.; CustomPages
Retrieve the sign-out page settings: Retrieves the sign-out page settings; CustomPages
Retrieve an SMS template: Retrieves a specific template by `id`; Template
Retrieve the SSF stream status: Retrieves the status of an SSF stream. The status indicates whether the transmitter is able to transmit events over the stream.; SSFTransmitter
Retrieve the SSF stream configuration(s): Retrieves either a list of all known SSF stream configurations or the individual configuration if specified by ID. As stream configurations are tied to a client ID, you can only view the stream associated with the client ID of the request OAuth 2.0 access token.; SSFTransmitter
Retrieve a subscription for a role: Retrieves a subscription by `notificationType` for a specified Role; Subscription
Retrieve a subscription for a user: Retrieves a subscription by `notificationType` for a specified user. Returns an `AccessDeniedException` message if requests are made for another user.; Subscription
Retrieve the org third-party admin setting: Retrieves the third-party admin setting. See [Configure third-party administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) in the Okta product documentation.; OrgSettingAdmin
Retrieve a trusted origin: Retrieves a trusted origin; TrustedOrigin
Retrieve a UI schema: Retrieves a UI Schema by `id`; UISchema
Retrieve a user: Retrieves a user from your Okta org. You can substitute `me` for the `id` to fetch the current user linked to an API token or session cookie. * The request returns the user linked to the API token that is specified in the Authorization header, not the user linked to the active session. Details of the admin user who granted the API token is returned. * When the end user has an active Okta session, it is typically a CORS request from the browser. Therefore, it's possible to retrieve the current user without the Authorization header. When fetching a user by `login` or `login shortname`, [URL encode](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding) the request parameter to ensure that special characters are escaped properly. Logins with a `/` character can only be fetched by `id` due to URL issues with escaping the `/` character. If you don't know a user's ID, you can use the [List all users](/openapi/okta-management/management/user/listusers) endpoint to find it. > **Note:** Some browsers block third-party cookies by default, which disrupts Okta functionality in certain flows. See [Mitigate the impact of third-party cookie deprecation](https://help.okta.com/okta_help.htm?type=oie&id=ext-third-party-cookies).; User
Retrieve a user role assignment: Retrieves a role assigned to a user (identified by `userId`). The `roleAssignmentId` parameter is the unique identifier for either a standard role assignment object or a custom role resource set binding object.; RoleAssignmentAUser
Retrieve all user role governance sources: Retrieves the governance sources of a role (identified by `roleAssignmentId`) that's assigned to a user (identified by `userId`); RoleAssignmentAUser
Retrieve a user's classification: Retrieves a user's classification; UserClassification
Retrieve a user grant: Retrieves a grant for the specified user; UserGrant
Retrieve the user lockout settings: Retrieves the User Lockout Settings for an org; AttackProtection
Retrieve a JSON Web Key Set (JWKS) for the default provisioning connection: Retrieves a JWKS for the default provisioning connection. This can be used by the OAuth 2.0 app's `jwk_uri` property in the target org.; ApplicationConnections
Retrieve the user's risk: Retrieves the user risk object for a user ID; UserRisk
Retrieve a user schema: Retrieves the schema for a user type; Schema
Retrieve a user type: Retrieves a user type by ID. Use `default` to fetch the default user type.; UserType
Retrieve the customized webauthn URI content: Retrieves the content of the `webauthn` well-known URI; AssociatedDomainCustomizations
Retrieve the well-known app authenticator configuration: Retrieves the well-known app authenticator configuration. Includes an app authenticator's settings, supported methods, and other details.; Authenticator
Retrieve the Org metadata: Retrieves the org metadata, which includes the org ID, configured custom domains, and authentication pipeline; OrgSettingMetadata
Retrieve the SSF transmitter metadata: Retrieves SSF transmitter configuration metadata. This includes all supported endpoints and key information about certain properties of the Okta org as the transmitter, such as `delivery_methods_supported`, `issuer`, and `jwks_uri`.; SSFTransmitter
Retrieve a YubiKey OTP token: Retrieves the specified YubiKey OTP token by `id`; UserFactor
Grant Okta Aerial access to your org: Grants an Okta Aerial account consent to manage your org. If the org is a child org, consent is taken from the parent org. Grant calls directly to the child are not allowed.; OrgSettingSupport
Grant consent to scope: Grants consent for the app to request an OAuth 2.0 Okta scope; ApplicationGrants
Grant Okta Support access: Grants Okta Support temporary access to your org as an administrator for eight hours > **Note:** This resource is deprecated. Use the [Update an Okta Support case](/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) resource to grant Okta Support access for a support case. > For the corresponding Okta Admin Console feature, see [Give access to Okta Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access).; OrgSettingSupport
Link a user to IdP: Links an Okta user to an existing SAML or social identity provider (IdP). The SAML IdP must have `honorPersistentNameId` set to `true` to use this API. The [Name Identifier Format](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/settings&t=request) of the incoming assertion must be `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`.; IdentityProviderUsers
List the active signing key credential for IdP: Lists the active signing key credential for an identity provider (IdP); IdentityProviderSigningKeys
List all agent pools: Lists all agent pools with pagination support; AgentPools
List all agent pool updates: Lists all agent pool updates; AgentPools
List all custom AAGUIDs: Lists all custom Authenticator Attestation Global Unique Identifiers (AAGUIDs) in the org Only custom AAGUIDs that an admin has created are returned.; Authenticator
List all custom telephony providers: Lists all custom telephony providers that are configured in your org; CustomTelephonyProvider
List all Sign-In Widget versions: Lists all sign-in widget versions supported by the current org; CustomPages
List all API service integration instance secrets: Lists all client secrets for an API Service Integration instance by `apiServiceId`; ApiServiceIntegrations
List all API service integration instances: Lists all API Service Integration instances with a pagination option; ApiServiceIntegrations
List all API token metadata: Lists all the metadata of the active API tokens; ApiToken
List all assigned app links: Lists all app links for all direct or indirect (through group membership) assigned apps > **Note:** To list all apps in an org, use the [List all applications endpoint in the Applications API](/openapi/okta-management/management/tags/application/other/listapplications).; UserResources
List all app service accounts: Lists all app service accounts; ServiceAccount
List all client role app targets: Lists all OIN app targets for an `APP_ADMIN` role that's assigned to a client (by `clientId`).; RoleBTargetClient
List all application groups: Lists all app group assignments; ApplicationGroups
List all key credentials: Lists all key credentials for an app; ApplicationSSOCredentialKey
List all group role app targets: Lists all app targets for an `APP_ADMIN` role assignment to a group. The response includes a list of OIN-cataloged apps or app instances. The response payload for an app instance contains the `id` property, but an OIN-cataloged app doesn't.; RoleBTargetBGroup
List all admin role app targets: Lists all app targets for an `APP_ADMIN` role assigned to a user. The response is a list that includes OIN-cataloged apps or app instances. The response payload for an app instance contains the `id` property, but an OIN-cataloged app payload doesn't.; RoleBTargetAdmin
List all application users: Lists all assigned users for an app; ApplicationUsers
List all applications: Lists all apps in the org with pagination. A subset of apps can be returned that match a supported filter expression or query. The results are [paginated](/#pagination) according to the `limit` parameter. If there are multiple pages of results, the header contains a `next` link. Treat the link as an opaque value (follow it, don't parse it). > **Note:** To list all of a member's assigned app links, use the [List all assigned app links endpoint in the User Resources API](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/userresources/other/listapplinks).; Application
List all assigned apps: Lists all apps that are assigned to a group. See [Application Groups API](/openapi/okta-management/management/tags/applicationgroups/).; Group
List all user role assignments: Lists all roles assigned to a user (identified by `userId`); RoleAssignmentAUser
List all associated authorization servers: Lists all associated Authorization Servers by trusted type for the given `authServerId`; AuthorizationServerAssoc
List all authenticator enrollments: Lists all authenticator enrollments of the specified user; UserAuthenticatorEnrollments
List all methods of an authenticator: Lists all methods of an authenticator identified by `authenticatorId`; Authenticator
List all authenticators: Lists all authenticators; Authenticator
List all credential keys: Lists all of the current, future, and expired Keys used by the Custom Authorization Server; AuthorizationServerKeys
List all policies: Lists all policies; AuthorizationServerPolicies
List all policy rules: Lists all policy rules for the specified Custom Authorization Server and Policy; AuthorizationServerRules
List all authorization servers: Lists all custom authorization servers in the org; AuthorizationServer
List all behavior detection rules: Lists all behavior detection rules with pagination support; Behavior
List all role resource set bindings: Lists all bindings for a resource set with pagination support. The returned `roles` array contains the roles for each binding associated with the specified resource set. If there are more than 100 bindings for the specified resource set, `links.next` provides the resource with pagination for the next list of bindings.; RoleDResourceSetBinding
List all domains associated with a brand: Lists all domains associated with a brand by `brandId`; Brands
List all themes: Lists all the themes in your brand. > **Important:** Currently each org supports only one theme, therefore this contains a single object only.; Themes
List all brands: Lists all the brands in your org; Brands
List all values for a governance bundle entitlement: Lists all entitlement values that are specific to a governance bundle entitlement; GovernanceBundle
List all entitlements for a governance bundle: Lists all entitlements specific to a governance bundle; GovernanceBundle
List all CAPTCHA instances: Lists all CAPTCHA instances with pagination support. A subset of CAPTCHA instances can be returned that match a supported filter expression or query.; CAPTCHA
List all certificate signing requests: Lists all certificate signing requests for an app; ApplicationSSOCredentialKey
List all certificate signing requests: Lists all certificate signing requests (CSRs) for an identity provider (IdP); IdentityProviderSigningKeys
List all custom domains: Lists all verified custom domains for the org; CustomDomain
List all default device posture checks: Lists all default device posture checks. Default device posture checks are defined by Okta. Their type will always be `BUILTIN`.; DevicePostureCheck
List all device assurance policies: Lists all device assurance policies; DeviceAssurance
List all device integrations: Lists all device integrations for your org. Examples include Device Posture Provider, Windows Security Center, Chrome Device Trust, OSQuery, and Android Device Trust.; DeviceIntegrations
List all OS accounts for a device: Lists all OS accounts for a device by `deviceId`; Device
List all device posture checks: Lists all device posture checks; DevicePostureCheck
List all users for a device: Lists all Users for a device by `deviceId`; Device
List all devices: Lists all devices with pagination support. >**Note:** To list all devices enrolled by a user, use the [List all devices endpoint in the User Resources API](/openapi/okta-management/management/userresources/listuserdevices). You can return a subset of devices that match a supported search criteria using the `search` query parameter. Searches for devices based on the properties specified in the `search` parameter conforming SCIM filter specifications (case-insensitive). This data is eventually consistent. The API returns different results depending on specified queries in the request. Empty list is returned if no objects match `search` request. > **Note:** The `search` parameter results are sourced from an eventually consistent datasource and may not reflect the latest information. Don't use search results directly for record updates, as the data might be stale and therefore overwrite newer data, resulting in data loss. Use an `id` lookup for records that you update to ensure your results contain the latest data. This operation requires [URL encoding](https://www.w3.org/TR/html4/interact/forms.html#h-17.13.4.1). For example, `search=profile.displayName eq "Bob"` is encoded as `search=profile.displayName%20eq%20%22Bob%22`.; Device
List all email customizations: Lists all customizations of an email template <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is enabled, all existing customizations are retrieved, including customizations for additional languages. If disabled, only customizations for Okta-supported languages are returned.; CustomTemplates
List all email domains: Lists all the Email Domains in your org; EmailDomain
List all enrolled SMTP servers: Lists all the enrolled custom SMTP server configurations; EmailServer
List all email templates: Lists all supported email templates; CustomTemplates
List all event hooks: Lists all event hooks; EventHook
List all enrolled factors: Lists all enrolled factors for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/) that applies to the user. Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all enrolled factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America).; UserFactor
List all dependencies: Lists all feature dependencies for a specified feature. A feature's dependencies are the features that it requires to be enabled in order for itself to be enabled.; Feature
List all dependents: Lists all feature dependents for the specified feature. A feature's dependents are the features that need to be disabled in order for the feature itself to be disabled.; Feature
List all features: Lists all self-service features for your org; Feature
List all features: Lists all features for an app > **Note:** This request returns an error if provisioning isn't enabled for the app. > To set up provisioning, see [Update the default provisioning connection](/openapi/okta-management/management/applicationconnections/updatedefaultprovisioningconnectionforapplication).; ApplicationFeatures
List all configured federated claims: Lists all federated claims for your app; ApplicationSSOFederatedClaims
List all governance bundles: Lists all governance bundles for the Admin Console in your org; GovernanceBundle
List all grants for a client: Lists all grants for a specified user and client; UserGrant
List all group role assignments: Lists all assigned roles of a group by `groupId`; RoleAssignmentBGroup
List all group owners: Lists all owners for a specific group; GroupOwner
List all group push mappings: Lists all group push mappings with pagination support; GroupPushMapping
List all group rules: Lists all group rules for your org; GroupRule
List all client role group targets: Lists all group targets for a [`USER_ADMIN`](/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a client. If the role isn't scoped to specific group targets, Okta returns an empty array `[]`.; RoleBTargetClient
List all group role group targets: Lists all group targets for a [`USER_ADMIN`](/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a group. If the role isn't scoped to specific group targets, Okta returns an empty array `[]`.; RoleBTargetBGroup
List all admin role group targets: Lists all group targets for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. If the role isn't scoped to specific group targets, an empty array `[]` is returned.; RoleBTargetAdmin
List all member users: Lists all users that are a member of a group. The default user limit is set to a very high number due to historical reasons that are no longer valid for most orgs. This will change in a future version of this API. The recommended page limit is now `limit=200`.; Group
List all groups: Lists all groups with pagination support. > **Note:** To list all groups belonging to a member, use the [List all groups endpoint in the User Resources API](/openapi/okta-management/management/tags/userresources/other/listusergroups). The number of groups returned depends on the specified [`limit`](/openapi/okta-management/management/group/listgroups#group/listgroups/t=request&in=query&path=limit), if you have a search, filter, and/or query parameter set, and if that parameter is not null. We recommend using a limit less than or equal to 200. A subset of groups can be returned that match a supported filter expression, query, or search criteria. > **Note:** The `search` parameter results are sourced from an eventually consistent datasource and may not reflect the latest information.; Group
List all keys: Lists all keys; HookKey
List all users for IdP: Lists all the users linked to an identity provider (IdP); IdentityProviderUsers
List all IdP key credentials: Lists all identity provider (IdP) key credentials; IdentityProviderKeys
List all signing key credentials for IdP: Lists all signing key credentials for an identity provider (IdP); IdentityProviderSigningKeys
List all IdPs: Lists all identity provider (IdP) integrations with pagination. A subset of IdPs can be returned that match a supported filter expression or query.; IdentityProvider
List all identity source sessions: Lists all identity source sessions for the given identity source instance; IdentitySource
List all inline hooks: Lists all inline hooks or all inline hooks of a specific type. When listing a specific inline hook, you need to specify its type. The following types are currently supported: | Type Value | Name | |------------------------------------|----------------------------------------------------------------| | `com.okta.import.transform` | [User import inline hook](/openapi/okta-management/management/management/inlinehook/createuserimportinlinehook) | | `com.okta.oauth2.tokens.transform` | [Token inline hook](/openapi/okta-management/management/management/inlinehook/createtokeninlinehook) | | `com.okta.saml.tokens.transform` | [SAML assertion inline hook](/openapi/okta-management/management/management/inlinehook/createsamlassertioninlinehook) | | `com.okta.telephony.provider` | [Telephony inline hook](/openapi/okta-management/management/management/inlinehook/createtelephonyinlinehook) | | `com.okta.user.credential.password.import` | [Password import inline hook](openapi/okta-management/management/management/inlinehook/createpasswordimportinlinehook)| | `com.okta.user.pre-registration` | [Registration inline hook](/openapi/okta-management/management/management/inlinehook/create-registration-hook) |; InlineHook
List all allowed apps for a target app: Lists all apps allowed by this app to request interclient SSO using the interclient token; ApplicationInterclientTrustMappings
List all target apps for an allowed app: Lists all the target apps that allow this app to request interclient SSO using an interclient token; ApplicationInterclientTrustMappings
List all the OAuth 2.0 client JSON Web Keys: Lists all JSON Web Keys for an OAuth 2.0 client app; ApplicationSSOPublicKeys
List all linked object definitions: Lists all Linked Object definitions; LinkedObject
List the primary or all of the associated linked object values: Lists either the `self` link for the primary user or all associated users in the relationship specified by `relationshipName`. If the specified user isn't associated in any relationship, an empty array is returned. Use `me` instead of `id` to specify the current session user.; UserLinkedObject
List all System Log events: Lists all System Log events See [System Log query](https://developer.okta.com/docs/reference/system-log-query/) for further details and examples, and [System Log filters and search](https://help.okta.com/okta_help.htm?type=oie&id=csh-syslog-filters) for common use cases. By default, 100 System Log events are returned. If there are more events, see the [header link](https://developer.okta.com/docs/api/#link-header) for the `next` link, or increase the number of returned objects using the `limit` parameter. >**Note:** The value of the `clientSecret` property in the System Log is secured by a hashing function, and isn't the value used during authentication.; SystemLog
List the log stream schemas: Lists the schema for all log stream types visible for this org; Schema
List all log streams: Lists all log stream objects in your org. You can request a paginated list or a subset of log streams that match a supported filter expression.; LogStream
List all role resource set binding members: Lists all members of a role resource set binding with pagination support; RoleDResourceSetBindingMember
List all network zones: Lists all Network Zones with pagination. A subset of zones can be returned that match a supported filter expression or query. This operation requires URL encoding. For example, `filter=(id eq "nzoul0wf9jyb8xwZm0g3" or id eq "nzoul1MxmGN18NDQT0g3")` is encoded as `filter=%28id+eq+%22nzoul0wf9jyb8xwZm0g3%22+or+id+eq+%22nzoul1MxmGN18NDQT0g3%22%29`. Okta supports filtering on the `id`, `usage`, and `system` properties. See [Filter](https://developer.okta.com/docs/api/#filter) for more information on the expressions that are used in filtering.; NetworkZone
List all custom token claims: Lists all custom token Claims defined for a specified custom authorization server; AuthorizationServerClaims
List all OAuth 2.0 client secrets: Lists all client secrets for an OAuth 2.0 client app; ApplicationSSOPublicKeys
List all client resources for an authorization server: Lists all client resources for which the specified authorization server has tokens. > **Note:** To list a specific user's client resources for which they have tokens or grants, use the [List all clients endpoint in the User Resources API](/openapi/okta-management/management/userresources/listuserclients).; AuthorizationServerClients
List all Custom Authorization Server Public JSON Web Keys: Lists all the public keys used by the custom authorization server; OAuth2ResourceServerCredentialsKeys
List all custom token scopes: Lists all custom token scopes; AuthorizationServerScopes
List all application refresh tokens: Lists all refresh tokens for an app > **Note:** The results are [paginated](/#pagination) according to the `limit` parameter. > If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it).; ApplicationTokens
List all Okta managed user accounts: Lists all Okta managed user accounts in your org. Use the `match` parameter to search for accounts where the account name (`name`) or username (`username`) contains the specified value.; OktaManagedUserAccount
List all Okta Support cases: Lists all Okta Support cases that the requesting principal has permission to view; OrgSettingSupport
List all org contact types: Lists all org contact types for your Okta org; OrgSettingContact
List all blocked email domains: Lists all blocked email domains which are excluded from app migration; OktaPersonalSettings
List all policies: Lists all policies with the specified type; Policy
List all apps mapped to a policy: Lists all applications mapped to a policy identified by `policyId` > **Note:** Use [List all resources mapped to a policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/#tag/Policy/operation/listPolicyMappings) to list all applications mapped to a policy.; Policy
List all resources mapped to a policy: Lists all resources mapped to a policy identified by `policyId`; Policy
List all policy rules: Lists all policy rules; Policy
List all principal rate limits: Lists all Principal Rate Limit entities considering the provided parameters; PrincipalRateLimit
List all profile mappings: Lists all profile mappings in your org with [pagination](https://developer.okta.com/docs/api/#pagination). You can return a subset of profile mappings that match a supported `sourceId` and/or `targetId`. The results are [paginated](/#pagination) according to the `limit` parameter. If there are multiple pages of results, the Link header contains a `next` link that you should treat as an opaque value (follow it, don't parse it). See [Link Header](https://developer.okta.com/docs/api/#link-header). The response is a collection of profile mappings that include a subset of the profile mapping object's parameters. The profile mapping object describes the properties mapping between an Okta user and an app user profile using [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04).; ProfileMapping
List all push providers: Lists all push providers; PushProvider
List all realm assignment operations: Lists all realm assignment operations. The upper limit is 200 and operations are sorted in descending order from most recent to oldest by ID.; RealmAssignment
List all realm assignments: Lists all realm assignments; RealmAssignment
List all realms: Lists all realms. > **Note:** The `search` parameter results are sourced from an eventually consistent datasource and may not reflect the latest information.; Realm
List all refresh tokens for a client: Lists all refresh tokens issued by an authorization server for a specific Client; AuthorizationServerClients
List all refresh tokens for a client: Lists all refresh tokens issued for the specified user and client; UserOAuth
List all resource set resources: Lists all resources for the resource set; RoleCResourceSetResource
List all resource sets: Lists all resource sets with pagination support; RoleCResourceSet
List all custom role permissions: Lists all permissions for a custom role by `roleIdOrLabel`; RoleECustomPermission
List all custom roles: Lists all custom roles with pagination support; RoleECustom
List all client role assignments: Lists all roles assigned to a client app identified by `clientId`; RoleAssignmentClient
List all app grants: Lists all scope consent Grants for the app; ApplicationGrants
List all security events providers: Lists all security events provider instances; SSFReceiver
List all SMS templates: Lists all custom SMS templates. A subset of templates can be returned that match a template type.; Template
List all tokens from OIDC IdP: Lists the tokens minted by the social authentication provider when the user authenticates with Okta via Social Auth. Okta doesn't import all the user information from a social provider. If the app needs information that isn't imported, it can get the user token from this endpoint. Then the app can make an API call to the social provider with the token to request the additional information.; IdentityProviderUsers
List all subscriptions for a role: Lists all subscriptions available to a specified Role; Subscription
List all subscriptions for a user: Lists all subscriptions available to a specified user. Returns an `AccessDeniedException` message if requests are made for another user.; Subscription
List all supported factors: Lists all the supported factors that can be enrolled for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tags/policy/) that applies to the user. Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all supported factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America).; UserFactor
List all supported security questions: Lists all available security questions for the specified user; UserFactor
List all trusted origins: Lists all trusted origins; TrustedOrigin
List all UI schemas: Lists all UI Schemas in your org; UISchema
List all user blocks: Lists information about how the user is blocked from accessing their account; User
List all clients: Lists all client resources for which the specified user has grants or tokens > **Note:** To list all client resources for which a specified authorization server has tokens, use the [List all client resources for an authorization server in the Authorization Servers API](/openapi/okta-management/management/authorizationserverclients/listoauth2clientsforauthorizationserver).; UserResources
List all devices for an enrolled user: Lists all devices enrolled by a user > **Note:** To list all devices registered to an org, use the [List all devices endpoint in the Devices API](/openapi/okta-management/management/tags/device/other/listdevices).; UserResources
List all user grants: Lists all grants for the specified user; UserGrant
List all groups: Lists all groups of which the user is a member > **Note:** To list all groups in your org, use the [List all groups endpoints in the Groups API](/openapi/okta-management/management/group/listgroups).; UserResources
List all IdPs for user: Lists the identity providers (IdPs) associated with the user; IdentityProviderUsers
List all user types: Lists all user types in your org; UserType
List all users: Lists users in your org, with pagination in most cases. A subset of users can be returned that match a supported filter expression or search criteria. Different results are returned depending on specified queries in the request. > **Notes:** > * This operation omits users that have a status of `DEPROVISIONED` in the response. To return all users, use a filter or search query instead. > * The `search` parameter results are sourced from an eventually consistent datasource and may not reflect the latest information.; User
List all users with role assignments: Lists all users with role assignments; RoleAssignmentAUser
List all WebAuthn preregistration factors: Lists all WebAuthn preregistration factors for the specified user; WebAuthnPreregistration
List all YubiKey OTP tokens: Lists all YubiKey OTP tokens; UserFactor
Map a resource to a policy: Maps a resource to a policy identified by `policyId` > **Note:** Use the [Assign an app sign-in policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationPolicies/#tag/ApplicationPolicies/operation/assignApplicationPolicy) endpoint to assign an app sign-in policy to an app.; Policy
Opt in the Admin Console to entitlement management: Opts in the Admin Console to entitlement management; GovernanceBundle
Opt in to Okta user communication emails: Opts in all users of this org to Okta communication emails; OrgSettingCommunication
Opt out the Admin Console from entitlement management: Opts out the Admin Console from entitlement management; GovernanceBundle
Opt out of Okta user communication emails: Opts out all users of this org from Okta communication emails; OrgSettingCommunication
Pause an agent pool update: Pauses a running or queued agent pool update; AgentPools
Preview the application SAML metadata: Previews the SSO SAML metadata for an application; ApplicationSSO
Publish a certificate signing request: Publishes the certificate signing request (CSR) with a signed X.509 certificate and adds it into the signing key credentials for the identity provider (IdP) > **Notes:** > * Publishing a certificate completes the lifecycle of the CSR, and it's no longer accessible. > * If the validity period of the certificate is less than 90 days, a 400 error response is returned.; IdentityProviderSigningKeys
Publish a certificate signing request: Publishes a certificate signing request (CSR) for the app with a signed X.509 certificate and adds it into the application key credentials. > **Note:** Publishing a certificate completes the lifecycle of the CSR and it's no longer accessible.; ApplicationSSOCredentialKey
Publish a security event token: Publishes a security event token (SET) sent by a security events provider. After the token is verified, Okta ingests the event and performs any appropriate action.; SSFSecurityEventToken
Reactivate a user: Reactivates a user. Perform this operation only on users with a `PROVISIONED` or `RECOVERY` [status](/openapi/okta-management/management/user/listusers#user/listusers/t=response&c=200&path=status). This operation restarts the activation workflow if for some reason the user activation wasn't completed when using the `activationToken` from [Activate User](/openapi/okta-management/management/userlifecycle/activateuser). Users that don't have a password must complete the flow by completing the [Reset password](/openapi/okta-management/management/usercred/resetpassword) flow and MFA enrollment steps to transition the user to `ACTIVE` status. If `sendEmail` is `false`, returns an activation link for the user to set up their account. The activation token can be used to create a custom activation link.; UserLifecycle
Refresh a session: Refreshes an existing session using the `id` for that session. A successful response contains the refreshed session with an updated `expiresAt` timestamp.; Session
Unassign a client role app instance target: Unassigns an app instance target from a role assignment to a client app > **Note:** You can't remove the last app instance target from a role assignment. > If you need a role assignment that applies to all the apps, delete the role assignment with the instance target and create another one. See [Unassign a client role](/openapi/okta-management/management/tags/roleassignmentclient/other/deleterolefromclient).; RoleBTargetClient
Unassign a client role app target: Unassigns an OIN app target for a role assignment to a client app > **Note:** You can't remove the last OIN app target from a role assignment. > If you need a role assignment that applies to all apps, delete the role assignment with the target and create another one. See [Unassign a client role](/openapi/okta-management/management/tags/roleassignmentclient/other/deleterolefromclient).; RoleBTargetClient
Unassign a client role group target: Unassigns a Group target from a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a client app. > **Note:** You can't remove the last group target from a role assignment. If you need a role assignment that applies to all groups, delete the role assignment with the target and create another one. See [Unassign a client role](/openapi/okta-management/management/tags/roleassignmentclient/other/deleterolefromclient).; RoleBTargetClient
Replace an application: Replaces properties for an application > **Notes:** > * All required properties must be specified in the request body > * You can't modify system-assigned properties, such as `id`, `name`, `status`, `created`, and `lastUpdated`. The values for these properties in the PUT request body are ignored.; Application
Replace an authenticator: Replaces the properties for an authenticator identified by `authenticatorId`; Authenticator
Replace an authenticator method: Replaces a method of `methodType` for an authenticator identified by `authenticatorId`; Authenticator
Replace the authenticator settings: Replaces the Authenticator Settings for an org; AttackProtection
Replace an authorization server: Replaces an authorization server; AuthorizationServer
Replace a policy: Replaces a policy; AuthorizationServerPolicies
Replace a policy rule: Replaces the configuration of the Policy Rule defined in the specified Custom Authorization Server and Policy; AuthorizationServerRules
Replace a behavior detection rule: Replaces a Behavior Detection Rule by `behaviorId`; Behavior
Replace the blocked email domains: Replaces the list of blocked email domains which are excluded from app migration; OktaPersonalSettings
Replace a brand: Replaces a brand by `brandId` Passing an invalid `brandId` returns a `404 Not Found` status code with the error code `E0000007`. Not providing `agreeToCustomPrivacyPolicy` with `customPrivacyPolicyUrl` returns a `400 Bad Request` status code with the error code `E0000001`.; Brands
Replace a theme: Replaces a theme for a brand; Themes
Replace the customized well-known URI of the specific path: Replaces the content of a customized well-known URI that you specify. There are endpoint-specific format requirements when you update the content of a customized well-known URI. See [Customize associated domains](https://developer.okta.com/docs/guides/custom-well-known-uri/main/).; AssociatedDomainCustomizations
Replace a CAPTCHA instance: Replaces the properties for a specified CAPTCHA instance; CAPTCHA
Replace a custom AAGUID: Replaces a custom AAGUID for the specified Passkey (FIDO2 WebAuthn) authenticator; Authenticator
Replace a custom domain's brand: Replaces a custom domain's brand; CustomDomain
Replace the customized error page: Replaces the customized error page. The customized error page appears in your live environment.; CustomPages
Replace the customized sign-in page: Replaces the customized sign-in page. The customized sign-in page appears in your live environment.; CustomPages
Replace a device assurance policy: Replaces a device assurance policy by `deviceAssuranceId`; DeviceAssurance
Replace a device posture check: Replaces a device posture check by `postureCheckId`; DevicePostureCheck
Replace an email customization: Replaces an email customization using property values <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is disabled, requests to update a customization for an additional language return a `404 Not Found` error response.; CustomTemplates
Replace an email domain: Replaces associated username and sender display name by `emailDomainId`; EmailDomain
Replace the email template settings: Replaces an email template's settings; CustomTemplates
Replace an event hook: Replaces an event hook. Okta validates the new properties before replacing the existing values. Some event hook properties are immutable and can't be updated. Refer to the parameter description in the request body schema. >**Note:** Updating the `channel` property requires you to verify the hook again.; EventHook
Replace an existing identity source user: Replaces an existing user for the given identity source instance and external ID; IdentitySource
Replace a federated claim: Replaces a claim that will be included in tokens produced by federation protocols (for example: OIDC `id_tokens` or SAML Assertions); ApplicationSSOFederatedClaims
Replace the Okta application settings: Replaces the settings for an Okta app (also known as an Okta first-party app); OktaApplicationSettings
Replace a governance bundle: Replaces the properties of a governance bundle for the Admin Console; GovernanceBundle
Replace a group: Replaces the profile for a group of `OKTA_GROUP` type from your org. > **Note :** You only can modify profiles for groups of the `OKTA_GROUP` type. > > App imports are responsible for updating profiles for groups of the `APP_GROUP` type, such as Active Directory groups.; Group
Replace a group rule: Replaces a group rule > **Notes:** You can only update rules with a group whose status is set to `INACTIVE`. > > You currently can't update the `actions` section.; GroupRule
Replace a key: Replaces a key by `id` This request replaces existing properties after passing validation. > **Note:** The only parameter that you can update is the name of the key, which must be unique at all times.; HookKey
Replace an IdP: Replaces an identity provider (IdP) integration by `idpId`; IdentityProvider
Replace an IdP key credential: Replaces an identity provider (IdP) key credential by `kid`; IdentityProviderKeys
Replace an inline hook: Replaces an inline hook by `inlineHookId`. The submitted inline hook properties replace the existing properties after passing validation. >**Note:** Some properties are immutable and can't be updated.; InlineHook
Replace a log stream: Replaces the log stream object properties for a given ID. This operation is typically used to update the configuration of a log stream. Depending on the type of log stream you want to update, certain properties can't be modified after the log stream is initially created. Use the [Retrieve the log stream schema for the schema type](/openapi/okta-management/management/schema/getlogstreamschema) request to determine which properties you can update for the specific log stream type. Log stream properties with the `"writeOnce" : true` attribute can't be updated after creation. You must still specify these `writeOnce` properties in the request body with the original values in the PUT request. > **Note:** You don't have to specify properties that have both the `"writeOnce": true` and the `"writeOnly": true` attributes in the PUT request body. These property values are ignored even if you add them in the PUT request body.; LogStream
Replace a network zone: Replaces a Network Zone by `zoneId`. The replaced Network Zone type must be the same as the existing type. You can replace the usage (`POLICY`, `BLOCKLIST`) of a Network Zone by updating the `usage` attribute. **IP exempt zone** If you have the IP exempt zone feature enabled, you can allow traffic from specific gateway IPs irrespective of Okta ThreatInsight configurations, blocked network zones, or IP change events within Identity Threat Protection with Okta AI. When you enable this feature, Okta creates a zone called `DefaultExemptIpZone`. Gateway IPs that you add to this zone always have access to Okta resources. See [IP exempt zone](https://help.okta.com/okta_help.htm?type=oie&id=csh-about-ip-exempt-zone). > **Note:** You can't add trusted proxy IPs to this zone, delete the zone, or create additional exempt IP zones.; NetworkZone
Replace a custom token claim: Replaces a custom token Claim specified by the `claimId`; AuthorizationServerClaims
Replace a custom token scope: Replaces a custom token scope; AuthorizationServerScopes
Replace the Okta Personal admin settings: Replaces Okta Personal admin settings in a Workforce org; OktaPersonalSettings
Replace the contact type user: Replaces the user associated with the specified contact type; OrgSettingContact
Replace the Org general settings: Replaces the Org General Settings for your Okta org; OrgSettingGeneral
Replace a policy: Replaces the properties of a policy identified by `policyId`; Policy
Replace a policy rule: Replaces the properties for a policy rule identified by `policyId` and `ruleId`; Policy
Replace the preview error page: Replaces the preview error page. The preview error page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/error/preview`.; CustomPages
Replace the preview sign-in page: Replaces the preview sign-in page. The preview sign-in page contains unpublished changes and isn't shown in your live environment. Preview it at `${yourOktaDomain}/login/preview`.; CustomPages
Replace a principal rate limit: Replaces a principal rate limit entity by `principalRateLimitId`; PrincipalRateLimit
Replace a push provider: Replaces a push provider by `pushProviderId`; PushProvider
Replace the rate limit admin notification settings: Replaces the Rate Limit Admin Notification Settings and returns the configured properties; RateLimitSettings
Replace the per-client rate limit settings: Replaces the Per-Client Rate Limit Settings and returns the configured properties; RateLimitSettings
Replace the rate limit warning threshold percentage: Replaces the Rate Limit Warning Threshold Percentage and returns the configured property; RateLimitSettings
Replace the realm profile: Replaces the realm profile; Realm
Replace a realm assignment: Replaces a realm assignment; RealmAssignment
Replace a resource set: Replaces the label and description of a resource set. See [Supported resources](/openapi/okta-management/guides/roles/#supported-resources).; RoleCResourceSet
Replace the resource set resource conditions: Replaces the conditions of a resource identified by `resourceId` in a resource set; RoleCResourceSetResource
Replace a custom role: Replaces the label and description for a custom role by `roleIdOrLabel`; RoleECustom
Replace a custom role permission: Replaces a permission (specified by `permissionType`) for a custom role; RoleECustomPermission
Replace a security events provider: Replaces a security events provider instance specified by `id`; SSFReceiver
Replace the sign-out page settings: Replaces the sign-out page settings; CustomPages
Replace an SMS template: Replaces the SMS Template > **Notes:** You can't update the default SMS Template.; Template
Replace an SSF stream: Replaces all properties for an existing SSF stream configuration. If the `stream_id` isn't provided in the request body, the associated stream with the client ID (through the request OAuth 2.0 access token) is replaced.; SSFTransmitter
Replace a trusted origin: Replaces a trusted origin; TrustedOrigin
Replace a UI schema: Replaces a UI Schema by `id`; UISchema
Replace a user: Replaces a user's profile, credentials, or both using strict-update semantics. All profile properties must be specified when updating a user's profile with a `PUT` method. Any property not specified in the request is deleted. > **Important:** Don't use a `PUT` method for partial updates.; User
Replace the user's classification: Replaces the user's classification; UserClassification
Replace the user lockout settings: Replaces the User Lockout Settings for an org; AttackProtection
Replace a user type: Replaces an existing user type. This operation is a full update. > **Note**: The `name` of an existing user type can't be changed, but must be part of the request body. You can only replace the `displayName` and `description` elements.; UserType
Replace the org-wide CAPTCHA settings: Replaces the CAPTCHA settings object for your organization > **Note**: You can disable CAPTCHA for your organization by setting `captchaId` and `enabledPages` to `null`.; CAPTCHA
Resend a factor enrollment: Resends an `sms`, `call`, or `email` factor challenge as part of an enrollment flow. For `call` and `sms` factors, Okta enforces a rate limit of one OTP challenge per device every 30 seconds. You can configure your `sms` and `call` factors to use a third-party telephony provider. See the [Telephony inline hook reference](https://developer.okta.com/docs/reference/telephony-hook/). Okta alternates between SMS providers with every resend request to ensure delivery of SMS and Call OTPs across different carriers. > **Note:** Resend operations aren't allowed after a factor exceeds the activation rate limit. See [Activate a factor](./#tag/UserFactor/operation/activateFactor).; UserFactor
Reset the factors: Resets all factors for the specified user. All MFA factor enrollments return to the unenrolled state. The user's status remains `ACTIVE`. This link is present only if the user is currently enrolled in one or more MFA factors.; UserLifecycle
Reset a password: Resets a password. Generates a one-time token (OTT) that you can use to reset a user's password. You can automatically email the OTT link to the user or return the OTT to the API caller and distribute using a custom flow. This operation transitions the user to the `RECOVERY` status. The user is then not able to sign in or initiate a forgot password flow until they complete the reset flow. This operation provides an option to delete all the user's sessions. However, if the request is made in the context of a session owned by the specified user, that session isn't cleared. > **Note:** You can also use this API to convert a user with the Okta credential provider to use a federated provider. After this conversion, the user can't directly sign in with a password. > To convert a federated user back to an Okta user, use the default API call. If an email address is associated with multiple users, keep in mind the following to ensure a successful password recovery lookup: * Okta no longer includes deactivated users in the lookup. * The lookup searches sign-in IDs first, then primary email addresses, and then secondary email addresses. If `sendEmail` is `false`, returns a link for the user to reset their password.; UserCred
Resume an agent pool update: Resumes a running or queued agent pool update; AgentPools
Retrieve a client role: Retrieves a role assignment (identified by `roleAssignmentId`) for a client app (identified by `clientId`); RoleAssignmentClient
Retry an agent pool update: Retries an agent pool update if the update is unsuccessful or communication with Okta was interrupted during an agent auto-update; AgentPools
Revoke Okta Aerial access to your org: Revokes access of an Okta Aerial account to your Org. The revoke operation will fail if the org has already been added to an Aerial account.; OrgSettingSupport
Revoke an API token: Revokes an API token by `apiTokenId`; ApiToken
Revoke a certificate signing request: Revokes a certificate signing request (CSR) and deletes the key pair from the identity provider (IdP); IdentityProviderSigningKeys
Revoke a certificate signing request: Revokes a certificate signing request and deletes the key pair from the app; ApplicationSSOCredentialKey
Revoke the current API token: Revokes the API token provided in the Authorization header; ApiToken
Revoke all grants for a client: Revokes all grants for the specified user and client; UserGrant
Revoke an application token: Revokes the specified token for the specified app; ApplicationTokens
Revoke all application tokens: Revokes all OAuth 2.0 refresh tokens for the specified app. Any access tokens issued with these refresh tokens are also revoked, but access tokens issued without a refresh token aren't affected.; ApplicationTokens
Revoke Okta Support access: Revokes Okta Support access to your org > **Note:** This resource is deprecated. Use the [Update an Okta Support case](/openapi/okta-management/management/tags/orgsettingsupport/other/updateoktasupportcase) resource to revoke Okta Support access for a support case. > For the corresponding Okta Admin Console feature, see [Give access to Okta Support](https://help.okta.com/okta_help.htm?type=oie&id=settings-support-access).; OrgSettingSupport
Revoke a refresh token for a client: Revokes a refresh token for a Client; AuthorizationServerClients
Revoke all refresh tokens for a client: Revokes all refresh tokens for a Client; AuthorizationServerClients
Revoke an app grant: Revokes permission for the app to grant the given scope; ApplicationGrants
Revoke a session: Revokes the specified session; Session
Revoke a token for a client: Revokes the specified refresh and access tokens; UserOAuth
Revoke all refresh tokens for a client: Revokes all refresh tokens issued for the specified user and client; UserOAuth
Revoke a user grant: Revokes one grant for a specified user; UserGrant
Revoke all user grants: Revokes all grants for a specified user; UserGrant
Revoke all user sessions: Revokes all active identity provider sessions of the user. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user. You can also clear the user's remembered factors for all devices using the `forgetDevices` parameter. See [forgetDevices](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserSessions/#tag/UserSessions/operation/revokeUserSessions!in=query&path=forgetDevices&t=request). > **Note:** This operation doesn't clear the sessions created for web or native apps.; UserSessions
Rotate all credential keys: Rotates the current Keys for a Custom Authorization Server. If you rotate Keys, the `ACTIVE` Key becomes the `EXPIRED` Key, the `NEXT` Key becomes the `ACTIVE` Key, and the Custom Authorization Server immediately begins using the new active Key to sign tokens. > **Note:** Okta rotates your Keys automatically in `AUTO` mode. You can rotate Keys yourself in either mode. If Keys are rotated manually, you should invalidate any intermediate cache. and fetch the Keys again using the Keys endpoint.; AuthorizationServerKeys
Send a PIN to user: Sends the decoded PIN for the specified WebAuthn preregistration enrollment. PINs are sent to the user's email. To resend the PIN, call this operation again.; WebAuthnPreregistration
Send a test message from a custom telephony provider: Sends a test message (SMS or call) using the specified custom telephony provider to verify that the provider is configured correctly. You must provide a valid phone number and country code to send the test message. Send it to a phone number that you have access to so you can confirm that the message was received.; CustomTelephonyProvider
Send a test email: Sends a test email to the current user's primary and secondary email addresses. The email content is selected based on the following priority: 1. The email customization for the language specified in the `language` query parameter <x-lifecycle class="ea"></x-lifecycle> If Custom languages for Okta Email Templates is enabled and the `language` parameter is an additional language, the test email uses the customization corresponding to the language. 2. The email template's default customization 3. The email template's default content, translated to the current user's language You can only send customized test emails if you've configured a custom email domain. If you don't have a custom email domain, test emails use the Okta default template and are sent from the Okta email domain. > **Note:** Super admins can view customized email templates with the **Send a test email** request. However, when custom email templates are sent to super admins as part of actual email notification flows, the customizations aren't applied. Instead, the default email template is used. This only applies to super admins.; CustomTemplates
Set a custom telephony provider as a primary telephony provider: Sets a custom telephony provider as the primary telephony provider for the org. You can only set one provider as a primary provider at a time.; CustomTelephonyProvider
Set the hide dashboard footer preference: Sets the preference to hide the Okta End-User Dashboard footer for all end users of your org; OrgSettingCustomization
Set the show dashboard footer preference: Sets the preference to show the Okta UI footer for all end users of your org; OrgSettingCustomization
Start the import from the identity source: Starts the import from the identity source described by the uploaded bulk operations; IdentitySource
Start the failback of your org: Starts the failback of your org; DisasterRecovery
Start the failover of your org: Starts the failover of your org; DisasterRecovery
Stop an agent pool update: Stops an agent pool update; AgentPools
Submit a query for AD Group: Submits a query search on the on-premises agent to asynchronously fetch specific Active Directory (AD) attributes for a group. Returns a `resultId` that is used to poll for the results.; DirectoriesIntegration
Subscribe a role to a specific notification type: Subscribes a Role to a specified notification type. Changes to Role subscriptions override the subscription status of any individual users with the Role.; Subscription
Subscribe a user to a specific notification type: Subscribes the current user to a specified notification type. Returns an `AccessDeniedException` message if requests are made for another user.; Subscription
Suspend a Device: Suspends a device by setting its status to `SUSPENDED`. Use suspended devices to create and delete device user links. You can only unsuspend or deactivate suspended devices. > **Note:** `SUSPENDED` status is meant to be temporary, so it isn't destructive.; Device
Suspend a user: Suspends a user. Perform this operation only on users with an `ACTIVE` status. The user has a `SUSPENDED` status when the process completes. Suspended users can't sign in to Okta. They can only be unsuspended or deactivated. Their group and app assignments are retained.; UserLifecycle
Test an SMTP server configuration: Tests the specified custom SMTP server configuration; EmailServer
Unassign an admin role app instance target: Unassigns an app instance target from an `APP_ADMIN` role assignment to an admin user. > **Note:** You can't remove the last app instance target from a role assignment since this causes an exception. > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment and recreate a new one.; RoleBTargetAdmin
Unassign a group role app instance target: Unassigns an app instance target from an `APP_ADMIN` role assignment to a group > **Note:** You can't remove the last app instance target from a role assignment. > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment with the target and create another one. See [Unassign a group role](/openapi/okta-management/management/roleassignmentbgroup/unassignrolefromgroup).; RoleBTargetBGroup
Unassign an admin role app target: Unassigns an OIN app target from an `APP_ADMIN` role assignment to an admin user. > **Note:** You can't remove the last OIN app target from a role assignment since this causes an exception. > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment to the user and recreate a new one.; RoleBTargetAdmin
Unassign a group role app target: Unassigns an OIN app target from an `APP_ADMIN` role assignment to a group > **Note:** You can't remove the last app target from a role assignment. > If you need a role assignment that applies to all apps, delete the `APP_ADMIN` role assignment with the target and create another one. See [Unassign a group role](/openapi/okta-management/management/roleassignmentbgroup/unassignrolefromgroup).; RoleBTargetBGroup
Unassign an application group: Unassigns a Group from an app; ApplicationGroups
Unassign a group role group target: Unassigns a group target from a [`USER_ADMIN`](/openapi/okta-management/guides/roles/#standard-roles), `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to a group.; RoleBTargetBGroup
Unassign an admin role group target: Unassigns a group target from a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` role assignment to an admin user. > **Note:** You can't remove the last group target from a role assignment since this causes an exception. > If you need a role assignment that applies to all groups, delete the role assignment to the user and recreate a new one.; RoleBTargetAdmin
Unassign a role resource set binding member: Unassigns a member (identified by `memberId`) from a role resource set binding; RoleDResourceSetBindingMember
Unassign a group role: Unassigns a role assignment (identified by `roleAssignmentId`) from a group (identified by the `groupId`); RoleAssignmentBGroup
Unassign a user role: Unassigns a role assignment (identified by `roleAssignmentId`) from a user (identified by `userId`); RoleAssignmentAUser
Unassign an application user: Unassigns a user from an app For directories like Active Directory and LDAP, they act as the owner of the user's credential with Okta delegating authentication (DelAuth) to that directory. If this request is successful for a user when DelAuth is enabled, then the user is in a state with no password. You can then reset the user's password. > **Important:** This is a destructive operation. You can't recover the user's app profile. If the app is enabled for provisioning and configured to deactivate users, the user is also deactivated in the target app.; ApplicationUsers
Unassign a user from a group: Unassigns a user from a group with the `OKTA_GROUP` type. > **Note:** You only can modify memberships for groups of the `OKTA_GROUP` type. > > App imports are responsible for managing group memberships for groups of the `APP_GROUP` type, such as Active Directory groups.; Group
Unenroll a factor: Unenrolls an existing factor for the specified user. You can't unenroll a factor from a deactivated user. Unenrolling a factor allows the user to enroll a new factor. > **Note:** If you unenroll the `push` or the `signed_nonce` factors, Okta also unenrolls any other `totp`, `signed_nonce`, or Okta Verify `push` factors associated with the user.; UserFactor
Unlink a user from IdP: Unlinks the Okta user and the identity provider (IdP) user. The next time the user federates into Okta through this IdP, they have to re-link their account according to the account link policy.; IdentityProviderUsers
Unlock a user: Unlocks a user with a `LOCKED_OUT` status or unlocks a user with an `ACTIVE` status that's blocked from unknown devices. Unlocked users have an `ACTIVE` status and can sign in with their current password. > **Note:** This operation works with Okta-sourced users. It doesn't support directory-sourced accounts such as Active Directory.; UserLifecycle
Unsubscribe a role from a specific notification type: Unsubscribes a Role from a specified notification type. Changes to Role subscriptions override the subscription status of any individual users with the Role.; Subscription
Unsubscribe a user from a specific notification type: Unsubscribes the current user from a specified notification type. Returns an `AccessDeniedException` message if requests are made for another user.; Subscription
Unsuspend a Device: Unsuspends a device by returning its `status` to `ACTIVE`. >**Note:** Only devices with a `SUSPENDED` status can be unsuspended.; Device
Unsuspend a user: Unsuspends a user and returns them to the `ACTIVE` state. This operation can only be performed on users that have a `SUSPENDED` status.; UserLifecycle
Update an agent pool update by ID: Updates an agent pool update instance and returns the latest agent pool update; AgentPools
Update an agent pool update settings: Updates an agent pool update instance settings; AgentPools
Update an existing app service account: Updates an existing app service account specified by ID; ServiceAccount
Update an application user: Updates the profile or credentials of a user assigned to an app; ApplicationUsers
Update the app user profile schema for an app: Updates the app user schema. This updates, adds, or removes one or more custom profile properties or the nullability of a base property in the app user schema for an app. Changing a base property's nullability (for example, the value of its `required` field) is allowed only if it is nullable in the default predefined schema for the app. > **Note:** You must set properties explicitly to `null` to remove them from the schema; otherwise, `POST` is interpreted as a partial update. The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to apps. All users assigned to a given app use the same app user schema. Therefore, unlike the user schema operations, the app user schema operations all specify `default` and don't accept a schema ID.; Schema
Update the Okta Admin Console assignment setting: Updates the org setting to automatically assign the Okta Admin Console when an admin role is assigned > **Note:** This setting doesn't apply to the `SUPER_ADMIN` role. > When you assign the `SUPER_ADMIN` role to a user, the Admin Console is always assigned to the user regardless of the `autoAssignAdminAppSetting` setting.; OrgSettingAdmin
Update the bot protection configuration: Updates the bot protection configuration for your org; BotProtection
Update a CAPTCHA instance: Partially updates the properties of a specified CAPTCHA instance; CAPTCHA
Update the ThreatInsight configuration: Updates the ThreatInsight configuration for the org; ThreatInsight
Update a Cross App Access connection: Updates the Cross App Access connection with the specified ID; ApplicationCrossAppAccessConnections
Update a custom AAGUID: Updates the properties of a custom AAGUID by the `authenticatorId` and `aaguid` ID; Authenticator
Update a custom telephony provider credential: Updates the credentials of an existing custom telephony provider; CustomTelephonyProvider
Update the default provisioning connection: Updates the default provisioning connection for an app; ApplicationConnections
Update an SMTP server configuration: Updates the specified custom SMTP server configuration > **Note:** When you update an SMTP server configuration that uses OAuth 2.0 authentication, the [`authType`](#components/schemas/BaseEmailServer/properties/authType) property is required in the request body.; EmailServer
Update a feature: Updates a Feature object for an app > **Note:** This endpoint supports partial updates.; ApplicationFeatures
Update a feature lifecycle: Updates a feature's lifecycle status. Use this endpoint to enable or disable a feature for your org. Use the `mode=force` parameter to override dependency restrictions for a particular feature. Normally, you can't enable a feature if it has one or more dependencies that aren't enabled. When you use the `mode=force` parameter while enabling a feature, Okta first tries to enable any disabled features that this feature may have as dependencies. If you don't pass the `mode=force` parameter and the feature has dependencies that need to be enabled before the feature is enabled, a 400 error is returned. When you use the `mode=force` parameter while disabling a feature, Okta first tries to disable any enabled features that this feature may have as dependents. If you don't pass the `mode=force` parameter and the feature has dependents that need to be disabled before the feature is disabled, a 400 error is returned. The following chart shows the different state transitions for a feature. <img alt="Example" src="https://developer.okta.com/docs/api/images/features/update-ssfeat-flowchart.png" width="1000"/>; Feature
Update an application group: Updates a group assignment to an app; ApplicationGroups
Update an external directory group membership: Updates an Active Directory or LDAP group membership directly in the Active Directory or LDAP server. You can add or remove users from groups based on their identity and access requirements. This ensures that changes made to user access in Okta are reflected in AD or LDAP. When you use Okta Access Certifications to revoke a user's membership to an AD or LDAP group, the removal is reflected in AD or LDAP. See [AD Bidirectional Group Management](https://help.okta.com/okta_help.htm?type=oie&id=ad-bidirectional-group-mgmt) and [LDAP Bidirectional Group Management](https://help.okta.com/okta_help.htm?type=oie&id=ldap-bidirectional-group-mgmt).; DirectoriesIntegration
Update a group push mapping: Updates the status of a group push mapping; GroupPushMapping
Update the group profile schema: Updates the group profile schema. This updates, adds, or removes one or more custom profile properties in a group schema. Currently Okta does not support changing base group profile properties. > **Note:** You must set properties explicitly to `null` to remove them from the schema; otherwise, `POST` is interpreted as a partial update. The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to groups. All groups use the same group schema. Unlike user schema operations, group schema operations all specify `default` and don't accept a schema ID.; Schema
Update an identity source group: Updates a group to an identity source for the given identity source instance and group ID; IdentitySource
Update an identity source user: Updates a user to an identity source for the given identity source instance and external ID; IdentitySource
Update an inline hook: Updates an inline hook by `inlineHookId`; InlineHook
Update an Okta managed user account: Updates an existing Okta managed user account specified by ID. You can only update the `name`, `description`, `ownerUserIds`, and `ownerGroupIds` properties.; OktaManagedUserAccount
Update an Okta Support case: Updates access to the org for an Okta Support case: * You can enable, disable, or extend access to your org for an Okta Support case. * You can approve Okta Support access to your org for self-assigned cases. A self-assigned case is created and assigned by the same Okta Support user.; OrgSettingSupport
Update the Org general settings: Updates partial Org General Settings; OrgSettingGeneral
Update a profile mapping: Updates an existing profile mapping by adding, updating, or removing one or many property mappings; ProfileMapping
Update an SMS template: Updates only some of the SMS Template properties: * All properties within the custom SMS Template that have values are updated. * Any translation that doesn't exist is added. * Any translation with a null or empty value is removed. * Any translation with non-empty/null value is updated.; Template
Update an SSF stream: Updates properties for an existing SSF stream configuration. If the `stream_id` isn't provided in the request body, the associated stream with the client ID (through the request OAuth 2.0 access token) is updated.; SSFTransmitter
Update the org third-party admin setting: Updates the third-party admin setting. This setting allows third-party admins to perform administrative actions in the Admin Console, but they can't do any of the following: * Receive Okta admin email notifications * Contact Okta support * Sign in to the Okta Help Center See [Configure third-party administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) in the Okta product documentation.; OrgSettingAdmin
Update a user: Updates a user's profile or credentials with partial update semantics. > **Important:** Use the `POST` method for partial updates. Unspecified properties are set to null with `PUT`. `profile` and `credentials` can be updated independently or together with a single request. > **Notes:** > * Currently, the user type of a user can only be changed using a full replacement `PUT` operation. If the request parameters of a partial update include the `type` element from the user object, the value must match the existing type of the user. Only admins are permitted to change the user type of a user; end users are not allowed to change their own user type. > > * To update a current user's profile with partial semantics, you can use the `/api/v1/users/me` endpoint. But, a user can only update profile properties that they have write access for. Within the profile, if the user tries to update the primary or the secondary email IDs, verification emails are sent to those email IDs, and the fields are updated only upon verification. > > * You can update user profiles of users in the `DEPROVISIONED` status if you have the **Edit Deactivated User Profile Updates** option turned on in the Admin Console. See [deactivated user profiles](https://help.okta.com/okta_help.htm?type=oie&id=edit-deactivated-users). If you are using this endpoint to set a password, it sets a password without validating existing user credentials. This is an administrative operation. For operations that validate credentials, refer to the [Reset password](https://developer.okta.com/docs/api/openapi/okta-management/management/usercred/resetpassword), [Start forgot password flow](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/forgotPassword), and [Update password](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/changePassword) endpoints.; User
Update a user schema: Updates a user schema. Use this request to update, add, or remove one or more profile properties in a user schema. If you specify `default` for the `schemaId`, updates will apply to the default user type. Unlike custom user profile properties, limited changes are allowed to base user profile properties (permissions, nullability of the `firstName` and `lastName` properties, or pattern for `login`). You can't remove a property from the default schema if it's being referenced as a [`matchAttribute`](/openapi/okta-management/management/tags/identityprovider/other/createidentityprovider#other/createidentityprovider/t=request&path=policy/subject/matchattribute) in `SAML2` IdPs. Currently, all validation of SAML assertions are only performed against the default user type. > **Note:** You must set properties explicitly to `null` to remove them from the schema; otherwise, `POST` is interpreted as a partial update.; Schema
Update a user type: Updates an existing user type. This operation is a partial update. > **Note**: You can only update the `displayName` and `description` elements. The `name` of an existing user type can't be changed.; UserType
Upload an application logo: Uploads a logo for the app instance. If the app already has a logo, this operation replaces the previous logo. The logo is visible in the Admin Console as an icon for your app instance. If you have one `appLink` object configured, this logo also appears in the End-User Dashboard as an icon for your app. > **Note:** If you have multiple `appLink` objects, use the Admin Console to add logos for each app link. > You can't use the API to add logos for multiple app links.; ApplicationLogos
Upload the background image: Uploads and replaces the background image for the theme. The file must be in PNG, JPG, or GIF format and less than 2 MB in size.; Themes
Upload the favicon: Uploads and replaces the favicon for the theme; Themes
Upload the logo: Uploads and replaces the logo for the theme. The file must be in PNG, JPG, or GIF format and less than 100kB in size. For best results use landscape orientation, a transparent background, and a minimum size of 300px by 50px to prevent upscaling.; Themes
Upload the data to be deleted in Okta: Uploads external IDs of entities that need to be deleted in Okta from the identity source for the given session; IdentitySource
Upload the data to be upserted in Okta: Uploads entities that need to be inserted or updated in Okta from the identity source for the given session; IdentitySource
Upload the group memberships to be deleted in Okta: Uploads the group memberships that need to be deleted in Okta from the identity source for the given session; IdentitySource
Upload the group memberships to be upserted in Okta: Uploads the group memberships that need to be inserted or updated in Okta from the identity source for the given session; IdentitySource
Upload the group external IDs to be deleted in Okta: Uploads external IDs of groups that need to be deleted in Okta from the identity source for the given session; IdentitySource
Upload the group profiles without memberships to be upserted in Okta: Uploads the group profiles without memberships that need to be inserted or updated in Okta from the identity source for the given session; IdentitySource
Upload a YubiKey OTP seed: Uploads a seed for a user to enroll a YubiKey OTP; UserFactor
Upsert an API token network condition: Upserts an API Token Network Condition by `apiTokenId`; ApiToken
Upsert the custom domain's certificate: Upserts (creates or renews) the `MANUAL` certificate for the custom domain > **Notes:** > * If the existing `certificateSourceType` is `OKTA_MANAGED`, this operation changes the source type to `MANUAL`. Okta no longer manages and renews certificates for this domain after you provide a user-managed certificate. > * Okta supports TLS certificates and private keys that are PEM-encoded and 2048, 3072, or 4096 bits. See the [Custom domain guide](https://developer.okta.com/docs/guides/custom-url-domain/main/) for more details.; CustomDomain
Upsert the user's risk: Upserts (creates or updates) the user risk object for a user ID. You can optionally provide a `riskReason` to describe why the risk level is being changed. If `riskReason` isn't provided, the reason defaults to `override.by.admin`.; UserRisk
Verify a custom domain: Verifies the custom domain and validity of DNS records by `domainId`. Verify your custom domain to confirm that you own or control the domain and that you have properly configured the required DNS records. Furthermore, if the `certificateSourceType` in the domain is `OKTA_MANAGED`, then an attempt is made to obtain and install a certificate. After a certificate is obtained and installed by Okta, Okta manages the certificate including certificate renewal. Verify your custom domain after you've [created it](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/CustomDomain/#tag/CustomDomain/operation/createCustomDomain) and after you've added your DNS records to your domain provider. Okta doesn't verify your domain automatically. You must use the API to verify your custom domain if you change your DNS records or if you encounter issues with domain validation. > **Note:** DNS record changes can take time to propagate. If you recently updated your DNS records, you may need to wait before verifying your custom domain. If you encounter issues with domain verification, double-check your DNS records and ensure that they're correctly configured. See [Update your DNS records](https://developer.okta.com/docs/guides/custom-url-domain/main/#update-your-dns-txt).; CustomDomain
Verify an email domain: Verifies an Email Domain by `emailDomainId`; EmailDomain
Verify an event hook: Verifies that the event hook matches the provided `eventHookId`. To verify ownership, your endpoint must send information back to Okta in JSON format. See [Event hooks](https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request). Only `ACTIVE` and `VERIFIED` event hooks can receive events from Okta. If a response is not received within 3 seconds, the outbound request times out. One retry is attempted after a timeout or error response. If a successful response still isn't received, this operation returns a 400 error with more information about the failure.; EventHook
Verify a factor: Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Notes:** > - You can send standard push challenges or number matching push challenges to Okta Verify `push` factor enrollments. Use a [request body](https://developer.okta.com/docs/api/openapi/okta-management/management/userfactor/verifyfactor!path=2/useNumberMatchingChallenge&t=request) for number matching push challenges. > - To verify a `push` factor, use the **poll** link returned when you issue the challenge. See [Retrieve a factor transaction status](/openapi/okta-management/management/tags/userfactor/other/getfactortransactionstatus).; UserFactor
Verify the provisioning connection: Verifies the OAuth 2.0-based connection as part of the OAuth 2.0 consent flow. The validation of the consent flow is the last step of the provisioning setup for an OAuth 2.0-based connection. Currently, this operation only supports `office365`,`google`, `zoomus`, and `slack` apps.; ApplicationConnections
Verify a Relying Party ID domain: Verifies the [Relying Party identifier (RP ID)](https://www.w3.org/TR/webauthn/#relying-party-identifier) domain for the specified Passkey (FIDO2 WebAuthn) authenticator and the specific `webauthn` authenticator method; Authenticator
Verify an SSF stream: Verifies an SSF stream by publishing a verification event requested by a security events provider. > **Note:** A successful response doesn't indicate that the verification event was transmitted successfully, only that Okta has transmitted the event or will at some point in the future. The SSF receiver is responsible for validating and acknowledging successful transmission of the request by responding with HTTP Response Status Code 202.; SSFTransmitter

FAQ

Okta integration, answered

How do AI agents use Okta through Open Connector?: Your user connects Okta once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Okta tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Okta MCP server?: Yes. Open Connector can serve Okta as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Okta actions with credentials injected server-side.
Where do Okta credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Okta — keep the keys.

Open source, self-hostable, with Okta credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →