api.openapi.yaml Maven / Gradle / Ivy
Show all versions of okta-sdk-api Show documentation
openapi: 3.0.3
info:
contact:
email: [email protected]
name: Okta Developer Team
url: https://developer.okta.com/
description: Allows customers to easily access the Okta Management APIs
license:
name: Apache-2.0
url: https://www.apache.org/licenses/LICENSE-2.0.html
termsOfService: https://developer.okta.com/terms/
title: Okta Admin Management
version: 2024.08.3
x-logo:
url: logo.svg
backgroundColor: transparent
altText: Okta Developer
externalDocs:
description: Find more info here
url: https://developer.okta.com/docs/reference/core-okta-api/#design-principles
servers:
- url: "https://{yourOktaDomain}"
variables:
yourOktaDomain:
default: subdomain.okta.com
description: "The domain of your organization. This can be a provided subdomain\
\ of an official okta domain (okta.com, oktapreview.com, etc) or one of your\
\ configured custom domains."
tags:
- description: The Agent Pools API provides operation to manage the update settings
of the agents for your organization.
name: AgentPools
x-displayName: Agent Pools
- description: |
This API provides operations to manage API service integration instances in your organization.
For a current list of available API service integrations, see the [Okta Integration Network catalog](https://www.okta.com/integrations/?capability=api).
See [Add an API Service Integration](https://help.okta.com/okta_help.htm?type=oie&id=ext-add-api-service-integration) for corresponding admin instructions using the Admin Console.
If you want to build an API service integration, see [API service integrations in the OIN](https://developer.okta.com/docs/guides/oin-api-service-overview/).
name: ApiServiceIntegrations
x-displayName: API Service Integrations
- description: The API Tokens API provides operations to manage SSWS API tokens for
your organization.
name: ApiToken
x-displayName: API Tokens
- description: |-
The Applications API provides operations to manage apps in your org.
To create a custom app integration instance, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) operation with the schema provided in the request payload.
To create an app instance from the Okta Integration Network (OIN), use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
operation with the corresponding OIN app schema in the request body.
name: Application
x-displayName: Applications
- description: |
The Application Connections API provides operations for configuring connections to an app.
Okta supports token-based and OAuth 2.0-based provisioning connections for supported apps.
The following available provisioning connections are supported by the indicated apps:
| Connection | Description | Apps supported |
| -------------------------------- | -------------- | ----------- |
| Token | The provisioning API connection is based on bearer token authentication. | - Okta Org2Org (`okta_org2org`)
- Zscaler 2.0 (`zscalerbyz`)
|
| OAuth 2.0 | The provisioning API connection is based on OAuth 2.0 authentication. | - Google Workspace (`google`)
- Microsoft Office 365 (`office365`)
- Okta Org2Org (`okta_org2org`)
- Slack (`slack`)
- Zoom (`zoomus`)
|
> **Note:** The Okta Org2Org (`okta_org2org`) app isn't available in Okta Developer Edition orgs. If you need to test this feature in your Developer Edition org, contact your Okta account team.
name: ApplicationConnections
x-displayName: Application Connections
- description: |
The Application Features API supports operations to configure app provisioning feature settings.
You must have app provisioning enabled to configure provisioning features. See [Update the default Provisioning Connection](/openapi/okta-management/management/tag/ApplicationConnections/#tag/ApplicationConnections/operation/updateDefaultProvisioningConnectionForApplication).
The following available provisioning features are supported by the indicated apps:
| Feature | Description | Apps supported |
| -------------------- | -------------- | ----------- |
| `USER_PROVISIONING` | Similar to the app **Provisioning** > **To App** setting in the Admin Console, user profiles are pushed from Okta to the third-party app. You can configure rules for creating users, deactivating users, and syncing passwords. | - Google Workspace (`google`)
- Microsoft Office 365 (`office365`)
- Okta Org2Org (`okta_org2org`)
- Slack (`slack`)
- Zoom (`zoomus`)
- Zscaler 2.0 (`zscalerbyz`)
|
| `INBOUND_PROVISIONING` | Similar to the app **Provisioning** > **To Okta** provisioning setting in the Admin Console, user profiles are imported from the third-party app into Okta. You can schedule user import and configure rules for user creation and matching. | - Google Workspace (`google`)
- Microsoft Office 365 (`office365`)
- Okta Org2Org (`okta_org2org`)
- Slack (`slack`)
- Zoom (`zoomus`)
|
> **Note:** The Okta Org2Org (`okta_org2org`) app isn't available in Okta Developer Edition orgs. If you need to test this feature in your Developer Edition org, contact your Okta account team.
name: ApplicationFeatures
x-displayName: Application Features
- description: |
The Application Grants API provides a set of operations to manage scope consent grants for an app.
A scope consent grant represents an app's permission to include specific Okta scopes in OAuth 2.0 Bearer tokens.
If the app doesn't have permission to grant consent for a particular Okta scope, token requests that contain the scope are denied.
name: ApplicationGrants
x-displayName: Application Grants
- description: The Application Groups API provides a set of operations to manage group
assignment for an app.
name: ApplicationGroups
x-displayName: Application Groups
- description: Provides a resource to manage the application instance logo
name: ApplicationLogos
x-displayName: Application Logos
- description: The Application Policies API provides a resource to manage authentication
policies associated with an app.
name: ApplicationPolicies
x-displayName: Application Policies
- description: Provides a Single Sign-On (SSO) resource for an application
name: ApplicationSSO
x-displayName: Application SSO
- description: |
The Application Key Credentials API provides a set of operations to manage an app's key store credentials.
name: ApplicationSSOCredentialKey
x-displayName: Application Key Credentials
- description: |
The Application Client Authentication Credentials API provides a set of operations to manage credentials used for OAuth 2.0 client authentication as described in [Client authentication methods](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/client-auth/).
name: ApplicationSSOCredentialOAuth2ClientAuth
x-displayName: Application Client Auth Credentials
- description: |
Resource to manage OAuth 2.0 tokens for an app
> **Note:** To configure refresh tokens for an app, see
> [grant_types](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication!path=4/settings/oauthClient/grant_types&t=request)
> and [refresh_token](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication!path=4/settings/oauthClient/refresh_token&t=request).
name: ApplicationTokens
x-displayName: Application Tokens
- description: |
The Application Users API provides operations to manage app users and their assignments.
The object returned from assigning a user to an app is known as the Application User.
You can assign users to apps for:
* SSO only
* SSO and provisioning
name: ApplicationUsers
x-displayName: Application Users
- description: The Attack Protection API provides operations to configure the User
Lockout Settings and the Authenticator Settings in your org to protect against
password abuse.
name: AttackProtection
x-displayName: Attack Protection
- description: |-
The Authenticators Administration API provides operations to configure which Authenticators are available to end users for use when they sign in to applications.
End users are required to use one or more Authenticators based on the security requirements of the authentication policy.
Okta Identity Engine currently supports Authenticators for the following factors:
**Knowledge-based:**
* Password
* Security Question
**Possession-based:**
* Phone (SMS, voice call)
* Email
* WebAuthn
* Duo
* Custom app
name: Authenticator
x-displayName: Authenticators
- description: |-
Authorization Servers generate OAuth 2.0 and OpenID Connect tokens, including access tokens and ID tokens. The Okta Management API gives you the ability to configure and manage Authorization Servers and the security policies that are attached to them.
**Work with the Default Authorization Server**
Okta provides a pre-configured Custom Authorization Server with the name `default`. This Default Authorization Server includes a basic access policy and rule, which you can edit to control access. It allows you to specify `default` instead of the `authorizationServerId` in requests to it:
`https://${yourOktaDomain}/api/v1/authorizationServers/default`
vs
`https://${yourOktaDomain}/api/v1/authorizationServers/${authorizationServerId}` for other Custom Authorization Servers
name: AuthorizationServer
x-displayName: Authorization Servers
- description: "Associated authorization servers allow you to designate a trusted\
\ authorization server that you associate with another authorization server. This\
\ type of association provides a way to configure [token exchange](https://developer.okta.com/docs/guides/set-up-token-exchange/main/#trusted-servers)\
\ between other authorization servers under the same Okta tenant."
name: AuthorizationServerAssoc
x-displayName: Authorization Server Associated Servers
- description: Provides operations to manage custom token claims for the given `authServerId`
and `claimId`
name: AuthorizationServerClaims
x-displayName: Authorization Server Claims
- description: |-
These endpoints allow you to manage tokens issued by an authorization server for a particular client. For example, you can revoke every active refresh token for a specific client. You can also revoke specific tokens or manage tokens at the User level.
Read [Validate access tokens](https://developer.okta.com/docs/guides/validate-access-tokens/dotnet/main/) and [Validate ID tokens](https://developer.okta.com/docs/guides/validate-id-tokens/main/) to understand more about how OAuth 2.0 tokens work.
name: AuthorizationServerClients
x-displayName: Authorization Server Clients
- description: |-
Provides operations to manage [JSON Web Key](https://datatracker.ietf.org/doc/html/rfc7517) credentials for the given `authServerId`.
> **Note:** Looking for how to obtain the jwks_uri for your org or custom authorization server? See the [well-known OpenID metadata endpoint](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/CustomAS/#tag/CustomAS/operation/getWellKnownOpenIDConfigurationCustomAS) and the [well-known OAuth 2.0 metadata endpoint](https://developer.okta.com/docs/api/openapi/okta-oauth/oauth/tag/CustomAS/#tag/CustomAS/operation/getWellKnownOAuthConfigurationCustomAS).
name: AuthorizationServerKeys
x-displayName: Authorization Server Keys
- description: Provides operations to manage policies for the given `authServerId`.
name: AuthorizationServerPolicies
x-displayName: Authorization Server Policies
- description: "Provides operations to manage policy rules for the given `authServerId`,\
\ `policyId`, and `ruleId`."
name: AuthorizationServerRules
x-displayName: Authorization Server Rules
- description: "Provides operations to manage custom token scopes for the given `authServerId`\
\ and `scopeId`. See [scope properties](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/#scope-properties)."
name: AuthorizationServerScopes
x-displayName: Authorization Server Scopes
- description: The Behavior Rules API provides operations to manage the behavior detection
rules for your organization.
name: Behavior
x-displayName: Behavior Rules
- description: |-
These endpoints allow you to manage Brands, and their metadata, in your orgs. With Brands, you can customize the following:
* [The Okta-hosted sign-in page](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/CustomPages/)
* [The sign-out page](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/CustomPages/)
* [Error pages](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/CustomPages/)
* [Email templates](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/CustomTemplates/)
* [The Okta End-User Dashboard](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Themes/)
> **Note:** Some of the curl code examples on this page include SSWS API token authentication. However, Okta recommends using scoped OAuth 2.0 and OIDC access tokens to authenticate with Okta management APIs. OAuth 2.0 and OIDC access tokens provide fine-grain control over the bearer's actions on specific endpoints. See [Okta API authentication methods](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/).
name: Brands
x-displayName: Brands
- description: |-
As an option to increase org security, Okta supports CAPTCHA services to prevent automated sign-in attempts. You can integrate one of two providers: [hCaptcha](https://www.hcaptcha.com/) or [reCAPTCHA v2](https://developers.google.com/recaptcha/docs/invisible).
The vendor implementations supported by Okta are both invisible. They each run risk-analysis software in the background during user sign in to determine the likelihood that the user is a bot. This risk analysis is based on the settings that you configure with the provider that you choose.
Before you configure your org to use CAPTCHA, sign in to the vendor of your choice or sign up for an account. For more details, refer to [CAPTCHA integration](https://help.okta.com/okta_help.htm?type=oie&id=csh-captcha).
name: CAPTCHA
x-displayName: CAPTCHAs
- description: The Custom Domains API provides operations to manage custom domains
for your organization.
name: CustomDomain
x-displayName: Custom Domains
- description: |-
These endpoints allow you to customize the contents of various pages, including:
* The Okta-hosted sign-in page
* Error pages
* The sign-out page
> **Note:** Some of the curl code examples on this page include SSWS API token authentication. However, Okta recommends using scoped OAuth 2.0 and OIDC access tokens to authenticate with Okta management APIs. OAuth 2.0 and OIDC access tokens provide fine-grain control over the bearer's actions on specific endpoints. See [Okta API authentication methods](https://developer.okta.com/docs/api/openapi/okta-oauth/guides/overview/).
name: CustomPages
x-displayName: Custom Pages
- description: |-
These endpoints allow you to programmatically manage email customizations.
Okta provides many customizable email templates. For example, the `UserActivation` email template allows users to activate their account. Use email customizations to override a template's default content. See the [list of email templates](https://developer.okta.com/docs/guides/custom-email/main/#use-customizable-email-templates).
Each template has default content that Okta translates to any one of the supported languages. The following settings determine the language for emails sent from Okta to a user, if the user hasn't selected a specific display language:
* The user's locale property value (if specified)
* The org's display language
See [Supported languages](https://developer.okta.com/docs/guides/custom-email/main/#supported-languages).
The following constraints apply to email customizations:
* If an email template has any customizations at all, exactly one of them must be the default (where `isDefault` is `true`). Okta uses the default customization when no other customization applies to the user's language settings.
* Each email template can have only one customization for each supported language.
### Enable other locales
MIIDqDCCApCgAwIBAgIGAVGNO4qeMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEG
A1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEU
MBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJ
ARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODUwMDhaFw0xNzEyMTAxODUxMDdaMIGUMQswCQYD
VQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsG
A1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEc
MBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC
ggEBALAakG48bgcTWHdwmVLHig0mkiRejxIVm3wbzrNSJcBruTq2zCYZ1rGfVxTYON8kJqvkXPmv
kzWKhpEkvhubL+mx29XpXY0AsNIfgcm5xIV56yhXSvlMdqzGo3ciRwoACaF+ClNLxmXK9UTZD89B
bVVGCG5AEvja0eCQ0GYsO5i9aSI5aTroab8Aew31PuWl/RGQWmjVy8+7P4wwkKKJNKCpxMYDlhfa
WRp0zwUSbUCO0qEyeAYdZx6CLES4FGrDi/7D6G+ewWC+kbz1tL1XpF2Dcg3+IOlHrV6VWzz3rG39
v9zFIncjvoQJFDGWhpqGqcmXvgH0Ze3SVcVF01T+bK0CAwEAATANBgkqhkiG9w0BAQUFAAOCAQEA
AHmnSZ4imjNrIf9wxfQIcqHXEBoJ+oJtd59cw1Ur/YQY9pKXxoglqCQ54ZmlIf4GghlcZhslLO+m
NdkQVwSmWMh6KLxVM18/xAkq8zyKbMbvQnTjFB7x45bgokwbjhivWqrB5LYHHCVN7k/8mKlS4eCK
Ci6RGEmErjojr4QN2xV0qAqP6CcGANgpepsQJCzlWucMFKAh0x9Kl8fmiQodfyLXyrebYsVnLrMf
jxE1b6dg4jKvv975tf5wreQSYZ7m//g3/+NnuDKkN/03HqhV7hTNi1fyctXk8I5Nwgyr+pT5LT2k
YoEdncuy+GQGzE9yLOhC4HNfHQXpqp2tMPdRlw==
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
schema:
description: SAML metadata in XML
type: string
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.read
summary: Preview the application SAML metadata
tags:
- ApplicationSSO
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
- text/xml
/api/v1/apps/{appId}/tokens:
delete:
description: "Revokes all OAuth 2.0 refresh tokens for the specified app. Any\
\ access tokens issued with these refresh tokens are also revoked, but access\
\ tokens issued without a refresh token aren't affected."
operationId: revokeOAuth2TokensForApplication
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Revoke all Application Tokens
tags:
- ApplicationTokens
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: |
Lists all refresh tokens for an app
> **Note:** The results are [paginated](/#pagination) according to the `limit` parameter.
> If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it).
operationId: listOAuth2TokensForApplication
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: "An optional parameter to return scope details in the `_embedded`\
\ property. Valid value: `scope`"
explode: true
in: query
name: expand
required: false
schema:
example: scope
type: string
style: form
- description: "Specifies the pagination cursor for the next page of results.\
\ Treat this as an opaque value obtained through the next link relationship.\
\ See [Pagination](/#pagination)."
explode: true
in: query
name: after
required: false
schema:
example: "16275000448691"
type: string
style: form
- description: A limit on the number of objects to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
minimum: 1
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
getOAuth2TokenForApplicationListExample:
$ref: '#/components/examples/OAuth2RefreshTokenResponseListEx'
schema:
items:
$ref: '#/components/schemas/OAuth2RefreshToken'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.read
summary: List all Application Refresh Tokens
tags:
- ApplicationTokens
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/apps/{appId}/tokens/{tokenId}:
delete:
description: Revokes the specified token for the specified app
operationId: revokeOAuth2TokenForApplication
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: '`id` of Token'
explode: false
in: path
name: tokenId
required: true
schema:
example: sHHSth53yJAyNSTQKDJZ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Revoke an Application Token
tags:
- ApplicationTokens
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a refresh token for the specified app
operationId: getOAuth2TokenForApplication
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: '`id` of Token'
explode: false
in: path
name: tokenId
required: true
schema:
example: sHHSth53yJAyNSTQKDJZ
type: string
style: simple
- description: "An optional parameter to return scope details in the `_embedded`\
\ property. Valid value: `scope`"
explode: true
in: query
name: expand
required: false
schema:
example: scope
type: string
style: form
responses:
"200":
content:
application/json:
examples:
getOAuth2TokenForApplicationExample:
$ref: '#/components/examples/OAuth2RefreshTokenResponseEx'
schema:
$ref: '#/components/schemas/OAuth2RefreshToken'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.read
summary: Retrieve an Application Token
tags:
- ApplicationTokens
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/apps/{appId}/users:
get:
description: Lists all assigned users for an app
operationId: listApplicationUsers
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: "Specifies the pagination cursor for the next page of results.\
\ Treat this as an opaque value obtained through the next link relationship.\
\ See [Pagination](/#pagination)."
explode: true
in: query
name: after
required: false
schema:
example: "16275000448691"
type: string
style: form
- description: |
Specifies the number of objects to return per page.
If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it).
See [Pagination](/#pagination).
explode: true
in: query
name: limit
required: false
schema:
default: 50
format: int32
maximum: 500
minimum: 1
type: integer
style: form
- description: |
Specifies a filter for the list of Application Users returned based on their profile attributes.
The value of `q` is matched against the beginning of the following profile attributes: `userName`, `firstName`, `lastName`, and `email`.
This filter only supports the `startsWith` operation that matches the `q` string against the beginning of the attribute values.
> **Note:** For OIDC apps, user profiles don't contain the `firstName` or `lastName` attributes. Therefore, the query only matches against the `userName` or `email` attributes.
explode: true
in: query
name: q
required: false
schema:
example: sam
type: string
style: form
- description: |-
An optional query parameter to return the corresponding [User](/openapi/okta-management/management/tag/User/) object in the `_embedded` property.
Valid value: `user`
explode: true
in: query
name: expand
required: false
schema:
example: user
type: string
style: form
responses:
"200":
content:
application/json:
examples:
ListAppUsersExample:
$ref: '#/components/examples/AppUserListEx'
schema:
items:
$ref: '#/components/schemas/AppUser'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.read
summary: List all Application Users
tags:
- ApplicationUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Assigns a user to an app for:
* SSO only
Assignments to SSO apps typically don't include a user profile.
However, if your SSO app requires a profile but doesn't have provisioning enabled, you can add profile attributes in the request body.
* SSO and provisioning
Assignments to SSO and provisioning apps typically include credentials and an app-specific profile.
Profile mappings defined for the app are applied first before applying any profile properties that are specified in the request body.
> **Notes:**
> * When Universal Directory is enabled, you can only specify profile properties that aren't defined in profile mappings.
> * Omit mapped properties during assignment to minimize assignment errors.
operationId: assignUserToApplication
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
requestBody:
content:
application/json:
examples:
AppUserSSOEx:
$ref: '#/components/examples/AppUserAssignSSORequest'
AppUserProvEx:
$ref: '#/components/examples/AppUserAssignProvRequest'
schema:
$ref: '#/components/schemas/AppUserAssignRequest'
required: true
responses:
"200":
content:
application/json:
examples:
AppUserSSOEx:
$ref: '#/components/examples/AppUserSSOResponse'
AppUserProvEx:
$ref: '#/components/examples/AppUserProvResponse'
schema:
$ref: '#/components/schemas/AppUser'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AppUserProvEx:
$ref: '#/components/examples/ErrorAppUserForbiddenAction'
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Assign an Application User
tags:
- ApplicationUsers
x-codegen-request-body-name: appUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/apps/{appId}/users/{userId}:
delete:
description: |-
Unassigns a user from an app
For directories like Active Directory and LDAP, they act as the owner of the user's credential with Okta delegating authentication (DelAuth) to that directory.
If this request is successful for a user when DelAuth is enabled, then the user is in a state with no password. You can then reset the user's password.
> **Important:** This is a destructive operation. You can't recover the user's app profile. If the app is enabled for provisioning and configured to deactivate users, the user is also deactivated in the target app.
operationId: unassignUserFromApplication
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00u13okQOVWZJGDOAUVR
type: string
style: simple
- description: Sends a deactivation email to the administrator if `true`
explode: true
in: query
name: sendEmail
required: false
schema:
default: false
type: boolean
style: form
x-okta-added-version: 1.5.0
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Unassign an Application User
tags:
- ApplicationUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a specific user assignment for a specific app
operationId: getApplicationUser
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00u13okQOVWZJGDOAUVR
type: string
style: simple
- description: |-
An optional query parameter to return the corresponding [User](/openapi/okta-management/management/tag/User/) object in the `_embedded` property.
Valid value: `user`
explode: true
in: query
name: expand
required: false
schema:
example: user
type: string
style: form
responses:
"200":
content:
application/json:
examples:
GetAppUserExample:
$ref: '#/components/examples/AppUserProvExpandResponse'
schema:
$ref: '#/components/schemas/AppUser'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.read
summary: Retrieve an Application User
tags:
- ApplicationUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Updates the profile or credentials of a user assigned to an app
operationId: updateApplicationUser
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00u13okQOVWZJGDOAUVR
type: string
style: simple
requestBody:
content:
application/json:
examples:
AppUserUpdateCredEx:
$ref: '#/components/examples/AppUserUpdateCredRequest'
AppUserUpdateProfileEx:
$ref: '#/components/examples/AppUserUpdateProfileRequest'
schema:
$ref: '#/components/schemas/AppUserUpdateRequest'
required: true
responses:
"200":
content:
application/json:
examples:
AppUserUpdateCredEx:
$ref: '#/components/examples/AppUserCredUpdateResponse'
AppUserUpdateProfileEx:
$ref: '#/components/examples/AppUserProfUpdateResponse'
schema:
$ref: '#/components/schemas/AppUser'
description: Success
"400":
content:
application/json:
examples:
AppUserUpdateCredEx:
$ref: '#/components/examples/ErrorAppUserUpdateBadRequest'
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AppUserProvEx:
$ref: '#/components/examples/ErrorAppUserForbiddenAction'
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Update an Application User
tags:
- ApplicationUsers
x-codegen-request-body-name: appUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/apps/{appName}/{appId}/oauth2/callback:
post:
description: |
Verifies the OAuth 2.0-based connection as part of the OAuth 2.0 consent flow. The validation of the consent flow is the last step of the provisioning setup for an OAuth 2.0-based connection.
Currently, this operation only supports `office365`,`google`, `zoomus`, and `slack` apps.
operationId: verifyProvisioningConnectionForApplication
parameters:
- explode: false
in: path
name: appName
required: true
schema:
$ref: '#/components/schemas/OAuthProvisioningEnabledApp'
style: simple
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
- explode: true
in: query
name: code
required: false
schema:
description: Unique string associated with each authentication request
type: string
style: form
- explode: true
in: query
name: state
required: false
schema:
description: A temporary code string that the client exchanges for an access
token
type: string
style: form
responses:
"204":
description: No content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Verify the Provisioning Connection
tags:
- ApplicationConnections
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/authenticators:
get:
description: Lists all authenticators
operationId: listAuthenticators
responses:
"200":
content:
application/json:
examples:
OrgAuthenticatorsEx:
$ref: '#/components/examples/AuthenticatorsResponse'
schema:
items:
$ref: '#/components/schemas/AuthenticatorBase'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.authenticators.read
summary: List all Authenticators
tags:
- Authenticator
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
post:
description: Creates an authenticator
operationId: createAuthenticator
parameters:
- description: Whether to execute the activation lifecycle operation when Okta
creates the authenticator
explode: true
in: query
name: activate
required: false
schema:
default: true
type: boolean
style: form
requestBody:
$ref: '#/components/requestBodies/AuthenticatorRequestBody'
responses:
"200":
content:
application/json:
examples:
Duo:
$ref: '#/components/examples/AuthenticatorResponseDuo'
Email:
$ref: '#/components/examples/AuthenticatorResponseEmail'
Password:
$ref: '#/components/examples/AuthenticatorResponsePassword'
Phone:
$ref: '#/components/examples/AuthenticatorResponsePhone'
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseWebAuthn'
SecurityQuestion:
$ref: '#/components/examples/AuthenticatorResponseSecurityQuestion'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.authenticators.manage
summary: Create an Authenticator
tags:
- Authenticator
x-codegen-request-body-name: authenticator
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/authenticators/{authenticatorId}:
get:
description: Retrieves an authenticator from your Okta organization by `authenticatorId`
operationId: getAuthenticator
parameters:
- description: '`id` of the Authenticator'
explode: false
in: path
name: authenticatorId
required: true
schema:
example: aut1nd8PQhGcQtSxB0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Duo:
$ref: '#/components/examples/AuthenticatorResponseDuo'
Email:
$ref: '#/components/examples/AuthenticatorResponseEmail'
Password:
$ref: '#/components/examples/AuthenticatorResponsePassword'
Phone:
$ref: '#/components/examples/AuthenticatorResponsePhone'
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseWebAuthn'
SecurityQuestion:
$ref: '#/components/examples/AuthenticatorResponseSecurityQuestion'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.authenticators.read
summary: Retrieve an Authenticator
tags:
- Authenticator
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
put:
description: Replaces the properties for an Authenticator identified by `authenticatorId`
operationId: replaceAuthenticator
parameters:
- description: '`id` of the Authenticator'
explode: false
in: path
name: authenticatorId
required: true
schema:
example: aut1nd8PQhGcQtSxB0g4
type: string
style: simple
requestBody:
$ref: '#/components/requestBodies/AuthenticatorRequestBody'
responses:
"200":
content:
application/json:
examples:
Duo:
$ref: '#/components/examples/AuthenticatorResponseDuo'
Email:
$ref: '#/components/examples/AuthenticatorResponseEmail'
Password:
$ref: '#/components/examples/AuthenticatorResponsePassword'
Phone:
$ref: '#/components/examples/AuthenticatorResponsePhone'
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseWebAuthn'
SecurityQuestion:
$ref: '#/components/examples/AuthenticatorResponseSecurityQuestion'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.authenticators.manage
summary: Replace an Authenticator
tags:
- Authenticator
x-codegen-request-body-name: authenticator
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/authenticators/{authenticatorId}/lifecycle/activate:
post:
description: Activates an authenticator by `authenticatorId`
operationId: activateAuthenticator
parameters:
- description: '`id` of the Authenticator'
explode: false
in: path
name: authenticatorId
required: true
schema:
example: aut1nd8PQhGcQtSxB0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Duo:
$ref: '#/components/examples/AuthenticatorResponseDuo'
Email:
$ref: '#/components/examples/AuthenticatorResponseEmail'
Password:
$ref: '#/components/examples/AuthenticatorResponsePassword'
Phone:
$ref: '#/components/examples/AuthenticatorResponsePhone'
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseWebAuthn'
SecurityQuestion:
$ref: '#/components/examples/AuthenticatorResponseSecurityQuestion'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.authenticators.manage
summary: Activate an Authenticator
tags:
- Authenticator
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/authenticators/{authenticatorId}/lifecycle/deactivate:
post:
description: Deactivates an authenticator by `authenticatorId`
operationId: deactivateAuthenticator
parameters:
- description: '`id` of the Authenticator'
explode: false
in: path
name: authenticatorId
required: true
schema:
example: aut1nd8PQhGcQtSxB0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseInactiveWebAuthn'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.authenticators.manage
summary: Deactivate an Authenticator
tags:
- Authenticator
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/authenticators/{authenticatorId}/methods:
get:
description: |-
Lists all Methods of an Authenticator identified by `authenticatorId`
> **Note:** Defaults to the current user's language given\
\ the following: \n- Custom languages for Okta Email Templates is enabled\n\
- An additional language is specified for the `language` parameter\n"
operationId: getEmailDefaultContent
parameters:
- description: The ID of the brand
explode: false
in: path
name: brandId
required: true
schema:
type: string
style: simple
- description: The name of the email template
explode: false
in: path
name: templateName
required: true
schema:
type: string
style: simple
- description: The language to use for the email. Defaults to the current user's
language if unspecified.
explode: true
in: query
name: language
required: false
schema:
$ref: '#/components/schemas/Language'
style: form
responses:
"200":
content:
application/json:
examples:
Get email template default content response:
$ref: '#/components/examples/EmailTemplateDefaultContentResponse'
schema:
$ref: '#/components/schemas/EmailDefaultContent'
description: Successfully retrieved the email template's default content.
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.templates.read
summary: Retrieve an Email Template Default Content
tags:
- CustomTemplates
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/brands/{brandId}/templates/email/{templateName}/default-content/preview:
get:
description: |
Retrieves a preview of an Email Template's default content. All variable references are populated using the current user's context. For example, `${user.profile.firstName}`.
Don't use search results directly for record updates, as the data might be stale and therefore overwrite newer data, resulting in data loss.
Use an `id` lookup for records that you update to ensure your results contain the latest data.
This operation requires [URL encoding](https://www.w3.org/TR/html4/interact/forms.html#h-17.13.4.1). For example, `search=profile.displayName eq "Bob"` is encoded as `search=profile.displayName%20eq%20%22Bob%22`.
operationId: listDevices
parameters:
- explode: true
in: query
name: after
required: false
schema:
description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the\
\ `Link` response header. See [Pagination](/#pagination) for more information."
example: 200u3des4afA47rYJu1d7
type: string
style: form
- description: A limit on the number of objects to return (recommend `20`)
explode: true
in: query
name: limit
required: false
schema:
default: 200
example: 20
maximum: 200
minimum: 1
type: integer
style: form
- description: "A SCIM filter expression that filters the results. Searches\
\ include all Device `profile` properties and the Device `id`, `status`,\
\ and `lastUpdated` properties."
examples:
Devices that have a `status` of `ACTIVE`:
value: status eq "ACTIVE"
Devices last updated after a specific timestamp:
value: lastUpdated gt "yyyy-MM-dd'T'HH:mm:ss.SSSZ"
Devices with a specified `id`:
value: id eq "guo4a5u7JHHhjXrMK0g4"
Devices that have a `displayName` of `Bob`:
value: profile.displayName eq "Bob"
Devices that have an `platform` of `WINDOWS`:
value: profile.platform eq "WINDOWS"
Devices whose `sid` starts with `S-1`:
value: profile.sid sw "S-1"
explode: true
in: query
name: search
required: false
schema:
example: lastUpdated gt "2019-06-01T09:00:00.000Z"
type: string
style: form
- description: Includes associated user details and management status for the
device in the `_embedded` attribute
examples:
UserFullDetails:
summary: Get a detailed list of associated users
value: user
UserSummaries:
summary: Get the list of associated user summaries
value: userSummary
explode: true
in: query
name: expand
required: false
schema:
enum:
- user
- userSummary
example: userSummary
type: string
x-enumDescriptions:
user: Lists full details for associated users
userSummary: Lists summaries for associated users
style: form
responses:
"200":
content:
application/json:
examples:
APIDevicesResponseUserSummaryExample:
$ref: '#/components/examples/APIDevicesListAllUserSummaryResponse'
APIDevicesResponseExample:
$ref: '#/components/examples/APIDevicesListAllResponse'
schema:
items:
$ref: '#/components/schemas/DeviceList'
type: array
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.read
summary: List all Devices
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/devices/{deviceId}:
delete:
description: |-
Deletes (permanently) a device by `deviceId` if it has a status of `DEACTIVATED`. You can transition the device to `DEACTIVATED` status using the [Deactivate a Device](/openapi/okta-management/management/tag/Device/#tag/Device/operation/deactivateDevice) endpoint.
This request is destructive and deletes all of the profile data related to the device. Once deleted, device data can't be recovered. However, reenrollment creates a new device record.
> **Note:** Attempts to delete a device that isn't in a `DEACTIVATED` state raise an error.
operationId: deleteDevice
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.manage
summary: Delete a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
get:
description: Retrieves a device by `deviceId`
operationId: getDevice
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
APIDevicesResponseExample:
$ref: '#/components/examples/DeviceResponse'
schema:
$ref: '#/components/schemas/Device'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.read
summary: Retrieve a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/devices/{deviceId}/lifecycle/activate:
post:
description: |-
Activates a Device by setting its status to ACTIVE by `deviceId`.
Activated devices are used to create and delete Device user links.
operationId: activateDevice
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.manage
summary: Activate a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/devices/{deviceId}/lifecycle/deactivate:
post:
description: |-
Deactivates a Device by setting its status to DEACTIVATED by `deviceId`.
Deactivation causes a Device to lose all device user links.
Set the Device status to DEACTIVATED before deleting it.
> **Note:** When deactivating a Device, keep in mind the following:
- Device deactivation is a destructive operation for device factors and client certificates. Device reenrollment using Okta Verify allows end users to set up new factors on the device.
- Device deletion removes the device record from Okta. Reenrollment creates a new device record.
operationId: deactivateDevice
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.manage
summary: Deactivate a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/devices/{deviceId}/lifecycle/suspend:
post:
description: |-
Suspends a Device by setting its status to SUSPENDED.
Use suspended devices to create and delete device user links.
You can only unsuspend or deactivate suspended devices.
> **Note:** SUSPENDED status is meant to be temporary, so it isn't destructive.
operationId: suspendDevice
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.manage
summary: Suspend a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/devices/{deviceId}/lifecycle/unsuspend:
post:
description: |-
Unsuspends a Device by returning its `status` to ACTIVE.
>**Note:** Only devices with a SUSPENDED status can be unsuspended.
operationId: unsuspendDevice
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.manage
summary: Unsuspend a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/devices/{deviceId}/users:
get:
description: Lists all Users for a Device by `deviceId`
operationId: listDeviceUsers
parameters:
- description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
APIDevicesListAllUsersResponseExample:
$ref: '#/components/examples/APIDevicesListAllUsersResponse'
schema:
items:
$ref: '#/components/schemas/DeviceUser'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.devices.read
summary: List all Users for a Device
tags:
- Device
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
/api/v1/directories/{appInstanceId}/groups/modify:
post:
description: Updates an AD Group membership directly in AD
operationId: updateADGroupMembership
parameters:
- description: ID of the AD AppInstance in Okta
explode: false
in: path
name: appInstanceId
required: true
schema:
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/AgentAction'
required: true
responses:
"200":
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"502":
content:
application/json:
examples:
AgentTimeOut:
$ref: '#/components/examples/ErrorAgentTimeOut'
schema:
$ref: '#/components/schemas/Error'
description: There are no connected agents.
"504":
content:
application/json:
examples:
AgentTimeOut:
$ref: '#/components/examples/ErrorNoConnectedAgents'
schema:
$ref: '#/components/schemas/Error'
description: Timed out waiting for agent.
security:
- oauth2:
- okta.directories.groups.manage
summary: Update an AD Group membership
tags:
- DirectoriesIntegration
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/domains:
get:
description: Lists all verified custom domains for the org
operationId: listCustomDomains
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/DomainListResponse'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.read
summary: List all Custom Domains
tags:
- CustomDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Creates your custom domain
operationId: createCustomDomain
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DomainRequest'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/DomainResponse'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.manage
summary: Create a Custom Domain
tags:
- CustomDomain
x-codegen-request-body-name: domain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/domains/{domainId}:
delete:
description: Deletes a custom domain by `domainId`
operationId: deleteCustomDomain
parameters:
- description: '`id` of the Domain'
explode: false
in: path
name: domainId
required: true
schema:
example: OmWNeywfTzElSLOBMZsL
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.manage
summary: Delete a Custom Domain
tags:
- CustomDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a custom domain by `domainId`
operationId: getCustomDomain
parameters:
- description: '`id` of the Domain'
explode: false
in: path
name: domainId
required: true
schema:
example: OmWNeywfTzElSLOBMZsL
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/DomainResponse'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.read
summary: Retrieve a Custom Domain
tags:
- CustomDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces a custom domain's brand
operationId: replaceCustomDomain
parameters:
- description: '`id` of the Domain'
explode: false
in: path
name: domainId
required: true
schema:
example: OmWNeywfTzElSLOBMZsL
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UpdateDomain'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/DomainResponse'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.manage
summary: Replace a Custom Domain's Brand
tags:
- CustomDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/domains/{domainId}/certificate:
put:
description: |-
Upserts (creates or renews) the `MANUAL` certificate for the custom domain
> **Notes:**
> * If the existing `certificateSourceType` is `OKTA_MANAGED`, this operation changes the source type to `MANUAL`. Okta no longer manages and renews certificates for this domain after you provide a user-managed certificate.
> * Okta supports TLS certificates and private keys that are PEM-encoded and 2048, 3072, or 4096 bits. See the [Custom domain guide](https://developer.okta.com/docs/guides/custom-url-domain/main/) for more details.
operationId: upsertCertificate
parameters:
- description: '`id` of the Domain'
explode: false
in: path
name: domainId
required: true
schema:
example: OmWNeywfTzElSLOBMZsL
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/DomainCertificate'
required: true
responses:
"204":
content: {}
description: No Content
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.manage
summary: Upsert the Custom Domain's Certificate
tags:
- CustomDomain
x-codegen-request-body-name: certificate
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/domains/{domainId}/verify:
post:
description: "Verifies the custom domain and validity of DNS records by `domainId`.\
\ Furthermore, if the `certificateSourceType` in the domain is `OKTA_MANAGED`,\
\ then an attempt is made to obtain and install a certificate. After a certificate\
\ is obtained and installed by Okta, Okta manages the certificate including\
\ certificate renewal."
operationId: verifyDomain
parameters:
- description: '`id` of the Domain'
explode: false
in: path
name: domainId
required: true
schema:
example: OmWNeywfTzElSLOBMZsL
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/DomainResponse'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.domains.manage
summary: Verify a Custom Domain
tags:
- CustomDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/email-domains:
get:
description: Lists all the Email Domains in your org
operationId: listEmailDomains
parameters:
- description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- brands
type: string
type: array
style: form
responses:
"200":
content:
application/json:
examples:
List email domain response:
$ref: '#/components/examples/EmailDomainResponse'
schema:
items:
$ref: '#/components/schemas/EmailDomainResponseWithEmbedded'
type: array
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailDomains.read
summary: List all Email Domains
tags:
- EmailDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Creates an Email Domain in your org
operationId: createEmailDomain
parameters:
- description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- brands
type: string
type: array
style: form
requestBody:
content:
application/json:
examples:
Create email domain request:
$ref: '#/components/examples/CreateEmailDomainRequest'
schema:
$ref: '#/components/schemas/EmailDomain'
required: true
responses:
"200":
content:
application/json:
examples:
Create email domain response:
$ref: '#/components/examples/EmailDomainResponse'
schema:
$ref: '#/components/schemas/EmailDomainResponse'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"409":
content:
application/json:
examples:
Email domain already exists:
$ref: '#/components/examples/ErrorEmailDomainAlreadyExists'
schema:
$ref: '#/components/schemas/Error'
description: Conflict
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailDomains.manage
summary: Create an Email Domain
tags:
- EmailDomain
x-codegen-request-body-name: emailDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/email-domains/{emailDomainId}:
delete:
description: Deletes an Email Domain by `emailDomainId`
operationId: deleteEmailDomain
parameters:
- explode: false
in: path
name: emailDomainId
required: true
schema:
description: The ID of the email domain.
type: string
style: simple
- description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- brands
type: string
type: array
style: form
responses:
"204":
content: {}
description: No Content
"400":
content:
application/json:
examples:
Email domain in use:
$ref: '#/components/examples/ErrorEmailDomainInUse'
schema:
$ref: '#/components/schemas/Error'
description: Unable to delete custom email domain due to mail provider specific
restrictions
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailDomains.manage
summary: Delete an Email Domain
tags:
- EmailDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves an Email Domain by `emailDomainId`
operationId: getEmailDomain
parameters:
- explode: false
in: path
name: emailDomainId
required: true
schema:
description: The ID of the email domain.
type: string
style: simple
- description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- brands
type: string
type: array
style: form
responses:
"200":
content:
application/json:
examples:
Retrieve email domain response:
$ref: '#/components/examples/EmailDomainResponse'
schema:
$ref: '#/components/schemas/EmailDomainResponseWithEmbedded'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailDomains.read
summary: Retrieve an Email Domain
tags:
- EmailDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces associated username and sender display name by `emailDomainId`
operationId: replaceEmailDomain
parameters:
- explode: false
in: path
name: emailDomainId
required: true
schema:
description: The ID of the email domain.
type: string
style: simple
- description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- brands
type: string
type: array
style: form
requestBody:
content:
application/json:
examples:
Update email domain request:
$ref: '#/components/examples/UpdateEmailDomainRequest'
schema:
$ref: '#/components/schemas/UpdateEmailDomain'
required: true
responses:
"200":
content:
application/json:
examples:
Update email domain response:
$ref: '#/components/examples/UpdatedEmailDomainResponse'
schema:
$ref: '#/components/schemas/EmailDomainResponse'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailDomains.manage
summary: Replace an Email Domain
tags:
- EmailDomain
x-codegen-request-body-name: updateEmailDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/email-domains/{emailDomainId}/verify:
post:
description: Verifies an Email Domain by `emailDomainId`
operationId: verifyEmailDomain
parameters:
- explode: false
in: path
name: emailDomainId
required: true
schema:
description: The ID of the email domain.
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Verified email domain response:
$ref: '#/components/examples/VerifiedEmailDomainResponse'
schema:
$ref: '#/components/schemas/EmailDomainResponse'
description: Success
"400":
content:
application/json:
examples:
Email domain could not be verified:
$ref: '#/components/examples/ErrorEmailDomainNotVerified'
Email domain invalid status:
$ref: '#/components/examples/ErrorEmailDomainInvalidStatus'
schema:
$ref: '#/components/schemas/Error'
description: Email domain could not be verified by mail provider
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailDomains.manage
summary: Verify an Email Domain
tags:
- EmailDomain
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/email-servers:
get:
description: Lists all the enrolled custom SMTP server configurations
operationId: listEmailServers
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/EmailServerListResponse'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailServers.read
summary: List all enrolled SMTP servers
tags:
- EmailServer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
post:
description: Creates a custom email SMTP server configuration for your org
operationId: createEmailServer
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EmailServerPost'
responses:
"201":
content:
application/json:
schema:
$ref: '#/components/schemas/EmailServerResponse'
description: Successfully enrolled server credentials
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailServers.manage
summary: Create a custom SMTP server
tags:
- EmailServer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/email-servers/{emailServerId}:
delete:
description: Deletes the specified custom SMTP server configuration
operationId: deleteEmailServer
parameters:
- explode: false
in: path
name: emailServerId
required: true
schema:
description: ID of your SMTP Server configuration
type: string
style: simple
responses:
"204":
description: No content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailServers.manage
summary: Delete an SMTP Server configuration
tags:
- EmailServer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
get:
description: Retrieves the specified custom SMTP server configuration
operationId: getEmailServer
parameters:
- explode: false
in: path
name: emailServerId
required: true
schema:
description: ID of your SMTP Server configuration
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/EmailServerListResponse'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailServers.read
summary: Retrieve an SMTP Server configuration
tags:
- EmailServer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
patch:
description: Updates the specified custom SMTP server configuration
operationId: updateEmailServer
parameters:
- explode: false
in: path
name: emailServerId
required: true
schema:
description: ID of your SMTP Server configuration
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EmailServerRequest'
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/EmailServerResponse'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailServers.manage
summary: Update an SMTP Server configuration
tags:
- EmailServer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/email-servers/{emailServerId}/test:
post:
description: Tests the specified custom SMTP Server configuration
operationId: testEmailServer
parameters:
- explode: false
in: path
name: emailServerId
required: true
schema:
description: ID of your SMTP Server configuration
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/EmailTestAddresses'
responses:
"204":
description: No content
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.emailServers.manage
summary: Test an SMTP Server configuration
tags:
- EmailServer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/eventHooks:
get:
description: Lists all event hooks
operationId: listEventHooks
responses:
"200":
content:
application/json:
examples:
RetrieveAllEventHooks:
$ref: '#/components/examples/RetrieveAllEventHooks'
schema:
items:
$ref: '#/components/schemas/EventHook'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.read
summary: List all Event Hooks
tags:
- EventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a new event hook for your organization in `ACTIVE` status. You pass an event hook object in the JSON payload
of your request. That object represents the set of required information about the event hook you're registering, including:
* The URI of your external service
* The [events](https://developer.okta.com/docs/reference/api/event-types/) in Okta you want to subscribe to
* An optional event hook filter that can reduce the number of event hook calls. This is a self-service Early Access (EA) feature.
See [Create an event hook filter](https://developer.okta.com/docs/concepts/event-hooks/#create-an-event-hook-filter).
Additionally, you can specify a secret API key for Okta to pass to your external service endpoint for security verification. Note that the API key you set here is unrelated to the Okta API token
you must supply when making calls to Okta APIs. Optionally, you can specify extra headers that Okta passes to your external
service with each call.
Your external service must use a valid HTTPS endpoint.
operationId: createEventHook
requestBody:
content:
application/json:
examples:
CreateAnEventHook:
$ref: '#/components/examples/CreateAnEventHook'
CreateAnEventHookWithFilter:
$ref: '#/components/examples/CreateAnEventHookWithFilter'
schema:
$ref: '#/components/schemas/EventHook'
required: true
responses:
"200":
content:
application/json:
examples:
CreateAnEventHook:
$ref: '#/components/examples/RetrieveAnEventHook'
CreateAnEventHookWithFilter:
$ref: '#/components/examples/RetrieveAnEventHookWithFilter'
schema:
$ref: '#/components/schemas/EventHook'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.manage
summary: Create an Event Hook
tags:
- EventHook
x-codegen-request-body-name: eventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/eventHooks/{eventHookId}:
delete:
description: |-
Deletes the event hook that matches the provided `id`. After deletion, the event hook is unrecoverable.
As a safety precaution, you can only delete event hooks with a status of `INACTIVE`.
operationId: deleteEventHook
parameters:
- description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.manage
summary: Delete an Event Hook
tags:
- EventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves an event hook
operationId: getEventHook
parameters:
- description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
RetrieveAnEventHook:
$ref: '#/components/examples/RetrieveAnEventHook'
schema:
$ref: '#/components/schemas/EventHook'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.read
summary: Retrieve an Event Hook
tags:
- EventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |-
Replaces an event hook. Okta validates the new properties before replacing the existing values.
Some event hook properties are immutable and can't be updated. Refer to the parameter description in the request body schema.
>**Note:** Updating the `channel` property requires you to verify the hook again.
operationId: replaceEventHook
parameters:
- description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
requestBody:
content:
application/json:
examples:
ReplaceAnEventHook:
$ref: '#/components/examples/ReplaceAnEventHookWithFilter'
schema:
$ref: '#/components/schemas/EventHook'
required: true
responses:
"200":
content:
application/json:
examples:
ReplaceAnEventHook:
$ref: '#/components/examples/RetrieveAnEventHookWithFilter'
schema:
$ref: '#/components/schemas/EventHook'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.manage
summary: Replace an Event Hook
tags:
- EventHook
x-codegen-request-body-name: eventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/eventHooks/{eventHookId}/lifecycle/activate:
post:
description: Activates the event hook that matches the provided `id`
operationId: activateEventHook
parameters:
- description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
ActivateAnEventHook:
$ref: '#/components/examples/RetrieveAnEventHook'
schema:
$ref: '#/components/schemas/EventHook'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.manage
summary: Activate an Event Hook
tags:
- EventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/eventHooks/{eventHookId}/lifecycle/deactivate:
post:
description: Deactivates the event hook that matches the provided `id`
operationId: deactivateEventHook
parameters:
- description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
DeactivateAnEventHook:
$ref: '#/components/examples/RetrieveADeactivatedEventHook'
schema:
$ref: '#/components/schemas/EventHook'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.manage
summary: Deactivate an Event Hook
tags:
- EventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/eventHooks/{eventHookId}/lifecycle/verify:
post:
description: |-
Verifies that the event hook matches the provided `eventHookId`. To verify ownership, your endpoint must send information back to Okta in JSON format. See [Event hooks](https://developer.okta.com/docs/concepts/event-hooks/#one-time-verification-request).
Only `ACTIVE` and `VERIFIED` event hooks can receive events from Okta.
If a response is not received within 3 seconds, the outbound request times out. One retry is attempted after a timeout or error response.
If a successful response still isn't received, this operation returns a 400 error with more information about the failure.
operationId: verifyEventHook
parameters:
- description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
VerifyAnEventHook:
$ref: '#/components/examples/RetrieveAnEventHook'
schema:
$ref: '#/components/schemas/EventHook'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.eventHooks.manage
summary: Verify an Event Hook
tags:
- EventHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/features:
get:
description: Lists all self-service features for your org
operationId: listFeatures
responses:
"200":
content:
application/json:
examples:
FeaturesList:
$ref: '#/components/examples/ListFeaturesResponse'
schema:
items:
$ref: '#/components/schemas/Feature'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.features.read
summary: List all Features
tags:
- Feature
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/features/{featureId}:
get:
description: Retrieves a feature by ID
operationId: getFeature
parameters:
- description: '`id` of the feature'
explode: false
in: path
name: featureId
required: true
schema:
example: R5HjqNn1pEqWGy48E9jg
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
FeaturesRetrieve:
$ref: '#/components/examples/RetrieveFeaturesResponse'
schema:
$ref: '#/components/schemas/Feature'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.features.read
summary: Retrieve a Feature
tags:
- Feature
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/features/{featureId}/dependencies:
get:
description: |-
Lists all feature dependencies for a specified feature.
A feature's dependencies are the features that it requires to be enabled in order for itself to be enabled.
operationId: listFeatureDependencies
parameters:
- description: '`id` of the feature'
explode: false
in: path
name: featureId
required: true
schema:
example: R5HjqNn1pEqWGy48E9jg
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
FeaturesDependenciesList:
$ref: '#/components/examples/ListFeatureDependenciesResponse'
schema:
items:
$ref: '#/components/schemas/Feature'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.features.read
summary: List all dependencies
tags:
- Feature
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/features/{featureId}/dependents:
get:
description: |-
Lists all feature dependents for the specified feature.
A feature's dependents are the features that need to be disabled in order for the feature itself to be disabled.
operationId: listFeatureDependents
parameters:
- description: '`id` of the feature'
explode: false
in: path
name: featureId
required: true
schema:
example: R5HjqNn1pEqWGy48E9jg
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
FeaturesDependentsList:
$ref: '#/components/examples/ListFeatureDependentsResponse'
schema:
items:
$ref: '#/components/schemas/Feature'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.features.read
summary: List all dependents
tags:
- Feature
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/features/{featureId}/{lifecycle}:
post:
description: |-
Updates a feature's lifecycle status. Use this endpoint to enable or disable a feature for your org.
Use the `mode=force` parameter to override dependency restrictions for a particular feature. Normally, you can't enable a feature if it has one or more dependencies that aren't enabled.
When you use the `mode=force` parameter while enabling a feature, Okta first tries to enable any disabled features that this feature may have as dependencies. If you don't pass the `mode=force` parameter and the feature has dependencies that need to be enabled before the feature is enabled, a 400 error is returned.
When you use the `mode=force` parameter while disabling a feature, Okta first tries to disable any enabled features that this feature may have as dependents. If you don't pass the `mode=force` parameter and the feature has dependents that need to be disabled before the feature is disabled, a 400 error is returned.
The following chart shows the different state transitions for a feature.
operationId: updateFeatureLifecycle
parameters:
- description: '`id` of the feature'
explode: false
in: path
name: featureId
required: true
schema:
example: R5HjqNn1pEqWGy48E9jg
type: string
style: simple
- description: Whether to `ENABLE` or `DISABLE` the feature
explode: false
in: path
name: lifecycle
required: true
schema:
$ref: '#/components/schemas/FeatureLifecycle'
style: simple
- description: Indicates if you want to force enable or disable a feature. Supported
value is `force`.
explode: true
in: query
name: mode
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
FeaturesUpdate:
$ref: '#/components/examples/UpdateFeatureLifecycleResponse'
schema:
$ref: '#/components/schemas/Feature'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.features.manage
summary: Update a Feature lifecycle
tags:
- Feature
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/first-party-app-settings/{appName}:
get:
description: Retrieves the settings for an Okta app (also known as an Okta first-party
app)
operationId: getFirstPartyAppSettings
parameters:
- description: |
The key name for the Okta app.
Supported apps:
* Okta Admin Console (`admin-console`)
explode: false
in: path
name: appName
required: true
schema:
example: admin-console
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
exampleSettings:
$ref: '#/components/examples/AdminConsoleSettingsExample'
schema:
$ref: '#/components/schemas/AdminConsoleSettings'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.read
summary: Retrieve the Okta Application Settings
tags:
- OktaApplicationSettings
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces the settings for an Okta app (also known as an Okta first-party
app)
operationId: replaceFirstPartyAppSettings
parameters:
- description: |
The key name for the Okta app.
Supported apps:
* Okta Admin Console (`admin-console`)
explode: false
in: path
name: appName
required: true
schema:
example: admin-console
type: string
style: simple
requestBody:
content:
application/json:
examples:
exampleSettings:
$ref: '#/components/examples/AdminConsoleSettingsExample'
schema:
$ref: '#/components/schemas/AdminConsoleSettings'
required: true
responses:
"200":
content:
application/json:
examples:
exampleSettings:
$ref: '#/components/examples/AdminConsoleSettingsExample'
schema:
$ref: '#/components/schemas/AdminConsoleSettings'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Replace the Okta Application Settings
tags:
- OktaApplicationSettings
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups:
get:
description: |-
Lists all Groups with pagination support.
The number of Groups returned depends on the specified [`limit`](/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!in=query&path=limit&t=request), if you have a search, filter, and/or query parameter set, and if that parameter is not null. We recommend using a limit less than or equal to 200.
A subset of Groups can be returned that match a supported filter expression, query, or search criteria.
> **Note:** Results from the filter or query parameter are driven from an eventually consistent datasource. The synchronization lag is typically less than one second.
See [Filtering](https://developer.okta.com/docs/api/#filter) for more information on expressions.
operationId: listGroups
parameters:
- description: |-
Finds a Group that matches the `name` property
> **Note:** Paging and searching are currently mutually exclusive. You can't page a query. The default limit for a query is 300 results. Query is intended for an auto-complete picker use case where users refine their search string to constrain the results.
explode: true
in: query
name: q
required: false
schema:
example: West&limit=10
type: string
style: form
- description: |-
[Filter expression](https://developer.okta.com/docs/reference/core-okta-api/#filter) for Groups
> **Note:** All filters must be [URL encoded](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding). For example, `filter=lastUpdated gt "2013-06-01T00:00:00.000Z"` is encoded as `filter=lastUpdated%20gt%20%222013-06-01T00:00:00.000Z%22`.
examples:
filterById:
summary: Filter group with a specific ID
value: id eq "00g1emaKYZTWRYYRRTSK"
filterByType:
summary: Filter groups that are of the type `OKTA_GROUP`
value: type eq "OKTA_GROUP"
filterByTypeAndProfileLastUpdatedAfterDate:
summary: Filter groups that are of the type `OKTA_GROUP` with Profile
updated after 11/11/2015
value: type eq "OKTA_GROUP" and lastUpdated gt "2016-11-11T00:00:00.000Z"
filterByTypeAndProfileOrMembershipUpdatedBeforeDate:
summary: Filter groups that are of the type `OKTA_GROUP` with Profile
or memberships updated before 11/11/2015
value: type eq "OKTA_GROUP" and (lastUpdated lt "2015-11-11T00:00:00.000Z"
or lastMembershipUpdated lt "2015-11-11T00:00:00.000Z")
explode: true
in: query
name: filter
required: false
schema:
type: string
style: form
- description: "Specifies the pagination cursor for the next page of Groups.\
\ The `after` cursor should be treated as an opaque value and obtained through\
\ the next link relation. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: |-
Specifies the number of Group results in a page.
Don't write code that depends on the default or maximum value, as it might change. If you receive an `HTTP 500` status code, you likely exceeded the request timeout. Retry your request with a smaller `limit` and [page the results](https://developer.okta.com/docs/api/#pagination).
The Okta default Everyone group isn't returned for users with a Group Admin role.
>**Note:** We strongly encourage using a limit that's less than or equal to 200. Any number greater than 200 affects performance and accuracy.
explode: true
in: query
name: limit
required: false
schema:
format: int32
maximum: 10000
type: integer
style: form
- description: "If specified, additional metadata is included in the response.\
\ Possible values are `stats` and `app`."
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
- description: |-
Searches for groups with a supported [filtering](https://developer.okta.com/docs/reference/core-okta-api/#filter) expression for all attributes except for `_embedded`, `_links`, and `objectClass`.
Search currently performs a `startsWith` match but it should be considered an implementation detail and might change without notice in the future. This operation supports [pagination](https://developer.okta.com/docs/api/#pagination).
Using search requires [URL encoding](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding), for example, `search=type eq "OKTA_GROUP"` is encoded as `search=type+eq+%22OKTA_GROUP%22`.
This operation searches many properties:
* Any group profile property, including imported app group profile properties.
* The top-level properties `id`, `created`, `lastMembershipUpdated`, `lastUpdated`, and `type`.
* The [source](/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=_links/source&t=response) of groups with type of `APP_GROUP`, accessed as `source.id`.
You can also use `sortBy` and `sortOrder` parameters.
examples:
searchByType:
summary: Search for Groups that have a type of `APP_GROUP`
value: type eq "APP_GROUP"
searchByLastMembershipUpdatedAfterDate:
summary: Search for Groups whose memberships were last updated after a
specific timestamp
value: lastMembershipUpdated gt "2014-01-01T00:00:00.000Z"
searchById:
summary: Search for Groups with the specified ID (`00gak46y5hydV6NdM0g4`)
value: id eq "00gak46y5hydV6NdM0g4"
searchByProfileName:
summary: Search for Groups that have a `name` of `West Coast Users`
value: profile.name eq "West Coast Users"
searchBySamAccountName:
summary: Search for Groups whose `samAccountName` starts with `West Coast`
value: profile.samAccountName sw "West Coast"
searchBySourceId:
summary: Search for Groups that have the source app with a specified `source.id`
(`0oa2v0el0gP90aqjJ0g7`)
value: source.id eq "0oa2v0el0gP90aqjJ0g7"
searchByIdTypeAndCreationDate:
summary: List groups of type `APP_GROUP` that were created before 01/01/2014
and whose source app has the ID 0oa2v0el0gP90aqjJ0g7
value: type eq "APP_GROUP" and (created lt "2014-01-01T00:00:00.000Z"
and source.id eq "0oa2v0el0gP90aqjJ0g7")
explode: true
in: query
name: search
required: false
schema:
type: string
style: form
- description: "Specifies field to sort by **(for search queries only)**. `sortBy`\
\ can be any single property, for example `sortBy=profile.name`."
explode: true
in: query
name: sortBy
required: false
schema:
example: lastUpdated
type: string
style: form
- description: "Specifies sort order: `asc` or `desc` (for search queries only).\
\ This parameter is ignored if if `sortBy` is not present. Groups with the\
\ same value for the `sortBy` property will be ordered by `id`"
explode: true
in: query
name: sortOrder
required: false
schema:
default: asc
type: string
style: form
responses:
"200":
content:
application/json:
examples:
ListGroupExample:
$ref: '#/components/examples/list-groups-examples'
schema:
items:
$ref: '#/components/schemas/Group'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: List all Groups
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Adds a new Group with the `OKTA_GROUP` type to your org
> **Note:** App import operations are responsible for syncing Groups with `APP_GROUP` type such as Active Directory Groups. See
[About groups](https://help.okta.com/okta_help.htm?id=Directory_Groups).
operationId: addGroup
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/addGroup_request'
required: true
responses:
"200":
content:
application/json:
examples:
GroupExample:
$ref: '#/components/examples/group-example'
schema:
$ref: '#/components/schemas/Group'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Add a Group
tags:
- Group
x-codegen-request-body-name: group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups/rules:
get:
description: Lists all Group rules for your org
operationId: listGroupRules
parameters:
- description: Specifies the number of rule results in a page
explode: true
in: query
name: limit
required: false
schema:
default: 50
format: int32
maximum: 200
minimum: 1
type: integer
style: form
- description: Specifies the pagination cursor for the next page of rules
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the keyword to search rules for
explode: true
in: query
name: search
required: false
schema:
type: string
style: form
- description: "If specified as `groupIdToGroupNameMap`, then displays group\
\ names"
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
x-okta-added-version: 1.3.0
responses:
"200":
content:
application/json:
examples:
ListGroupRulesExample:
$ref: '#/components/examples/list-group-rules-example'
schema:
items:
$ref: '#/components/schemas/GroupRule'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: List all Group rules
tags:
- GroupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a Group rule to dynamically add Users to the specified Group if they match the condition
> **Note:** Group rules are created with the status set to `'INACTIVE'`.
operationId: createGroupRule
requestBody:
content:
application/json:
examples:
GroupRuleExample:
$ref: '#/components/examples/create-group-rule-request-example'
schema:
$ref: '#/components/schemas/CreateGroupRuleRequest'
required: true
responses:
"200":
content:
application/json:
examples:
GroupRuleExample:
$ref: '#/components/examples/group-rule-example'
schema:
$ref: '#/components/schemas/GroupRule'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Create a Group rule
tags:
- GroupRule
x-codegen-request-body-name: groupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups/rules/{groupRuleId}:
delete:
description: Deletes a specific group rule by `groupRuleId`
operationId: deleteGroupRule
parameters:
- description: The `id` of the group rule
explode: false
in: path
name: groupRuleId
required: true
schema:
example: 0pr3f7zMZZHPgUoWO0g4
type: string
style: simple
- description: "If set to `true`, removes Users from Groups assigned by this\
\ rule"
explode: true
in: query
name: removeUsers
required: false
schema:
default: false
type: boolean
style: form
responses:
"202":
content: {}
description: Accepted
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Delete a Group Rule
tags:
- GroupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a specific Group rule by ID from your org
operationId: getGroupRule
parameters:
- description: The `id` of the group rule
explode: false
in: path
name: groupRuleId
required: true
schema:
example: 0pr3f7zMZZHPgUoWO0g4
type: string
style: simple
- description: "If specified as `groupIdToGroupNameMap`, then show Group names"
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
GroupRuleExample:
$ref: '#/components/examples/group-rule-example'
schema:
$ref: '#/components/schemas/GroupRule'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: Retrieve a Group rule
tags:
- GroupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |-
Replaces a Group rule
> **Notes:** You only can update rules with a Group whose status is set to `'INACTIVE'`.
>
> You currently can't update the `action` section.
operationId: replaceGroupRule
parameters:
- description: The `id` of the group rule
explode: false
in: path
name: groupRuleId
required: true
schema:
example: 0pr3f7zMZZHPgUoWO0g4
type: string
style: simple
requestBody:
content:
application/json:
examples:
GroupRuleExample:
$ref: '#/components/examples/group-rule-example'
schema:
$ref: '#/components/schemas/GroupRule'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/GroupRule'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Replace a Group rule
tags:
- GroupRule
x-codegen-request-body-name: groupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups/rules/{groupRuleId}/lifecycle/activate:
post:
description: Activates a specific Group rule by ID from your org
operationId: activateGroupRule
parameters:
- description: The `id` of the group rule
explode: false
in: path
name: groupRuleId
required: true
schema:
example: 0pr3f7zMZZHPgUoWO0g4
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Activate a Group Rule
tags:
- GroupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/rules/{groupRuleId}/lifecycle/deactivate:
post:
description: Deactivates a specific Group rule by ID from your org
operationId: deactivateGroupRule
parameters:
- description: The `id` of the group rule
explode: false
in: path
name: groupRuleId
required: true
schema:
example: 0pr3f7zMZZHPgUoWO0g4
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Deactivate a Group Rule
tags:
- GroupRule
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}:
delete:
description: |-
Deletes a Group of the `OKTA_GROUP` or `APP_GROUP` type from your org
> **Note:** You can't remove Groups of type `APP_GROUP` if they are used in a group push mapping.
operationId: deleteGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Delete a Group
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a specific Group by `id` from your org
operationId: getGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
GroupExample:
$ref: '#/components/examples/group-example'
schema:
$ref: '#/components/schemas/Group'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: Retrieve a Group
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |-
Replaces the profile for a Group of `OKTA_GROUP` type from your org
> **Note :** You only can modify profiles for groups of the `OKTA_GROUP` type.
>
> App imports are responsible for updating profiles for groups of the `APP_GROUP` type, such as Active Directory groups.
operationId: replaceGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/addGroup_request'
required: true
responses:
"200":
content:
application/json:
examples:
GroupExample:
$ref: '#/components/examples/group-example'
schema:
$ref: '#/components/schemas/Group'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Replace a Group
tags:
- Group
x-codegen-request-body-name: group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups/{groupId}/apps:
get:
description: "Lists all apps that are assigned to a Group. See [Application\
\ Groups API](/openapi/okta-management/management/tag/ApplicationGroups/)."
operationId: listAssignedApplicationsForGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: Specifies the pagination cursor for the next page of apps
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of app results for a page
explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
ListAppsExample:
$ref: '#/components/examples/list-apps-example'
schema:
items:
$ref: '#/components/schemas/Application'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: List all Assigned Applications
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/owners:
get:
description: Lists all owners for a specific group
operationId: listGroupOwners
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: SCIM Filter expression for group owners. Allows to filter owners
by type.
explode: true
in: query
name: search
required: false
schema:
type: string
style: form
- description: Specifies the pagination cursor for the next page of owners
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of owner results in a page
explode: true
in: query
name: limit
required: false
schema:
default: 1000
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
ListsOneOwnerOfaGroup:
$ref: '#/components/examples/ListsOwnerOneResponse'
ListsMultipleOwnersOfaGroup:
$ref: '#/components/examples/ListsOwnersMultipleResponse'
schema:
items:
$ref: '#/components/schemas/GroupOwner'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: List all Group Owners
tags:
- GroupOwner
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Assigns a group owner
operationId: assignGroupOwner
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
requestBody:
content:
application/json:
examples:
AssignAGroupOwner:
$ref: '#/components/examples/AssignGroupOwnerRequest'
schema:
$ref: '#/components/schemas/AssignGroupOwnerRequestBody'
required: true
responses:
"201":
content:
application/json:
examples:
AssignAGroupOwner:
$ref: '#/components/examples/AssignGroupOwnerResponse'
schema:
$ref: '#/components/schemas/GroupOwner'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Assign a Group Owner
tags:
- GroupOwner
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups/{groupId}/owners/{ownerId}:
delete:
description: Deletes a group owner from a specific group
operationId: deleteGroupOwner
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the group owner
explode: false
in: path
name: ownerId
required: true
schema:
example: 00u1emaK22TWRYd3TtG
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Delete a Group Owner
tags:
- GroupOwner
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles:
get:
description: Lists all assigned roles of a Group by `groupId`
operationId: listGroupAssignedRoles
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: "An optional parameter used to return targets configured for\
\ the standard Role Assignment in the `embedded` property. Supported values:\
\ `targets/groups` or `targets/catalog/apps`"
examples:
groupTarget:
summary: Return Group targets
value: targets/groups
appTarget:
summary: Return App targets
value: targets/catalog/apps
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
Standard Roles:
$ref: '#/components/examples/StandardRolesListResponseGroup'
Custom Roles:
$ref: '#/components/examples/CustomRolesListResponseGroup'
IAM-Based Standard Roles:
$ref: '#/components/examples/IAMStandardRolesListResponseGroup'
schema:
items:
$ref: '#/components/schemas/listGroupAssignedRoles_200_response_inner'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Group Role Assignments
tags:
- RoleAssignmentBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Assigns a [standard role](/openapi/okta-management/guides/roles/#standard-roles) to a Group.
You can also assign a custom role to a Group, but the preferred method to assign a custom role to a Group is to create a binding between the Custom Role, the Resource Set, and the Group. See [Create a Role Resource Set Binding](/openapi/okta-management/management/tag/RoleDResourceSetBinding/#tag/RoleDResourceSetBinding/operation/createResourceSetBinding).
> **Notes:**
> * The request payload is different for standard and custom role assignments.
> * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.
operationId: assignRoleToGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: Grants the Group third-party admin status when set to `true`
explode: true
in: query
name: disableNotifications
required: false
schema:
default: false
type: boolean
style: form
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/assignRoleToGroup_request'
required: true
responses:
"200":
content:
application/json:
examples:
Standard Roles:
$ref: '#/components/examples/CreateStandardRoleAssignmentResponseGroup'
Custom Roles:
$ref: '#/components/examples/CreateCustomRoleResponseGroup'
IAM-based Standard Roles:
$ref: '#/components/examples/CreateIAMStandardRoleResponseGroup'
schema:
$ref: '#/components/schemas/listGroupAssignedRoles_200_response_inner'
description: Success
"201":
content: {}
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign a Role to a Group
tags:
- RoleAssignmentBGroup
x-codegen-request-body-name: assignRoleRequest
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles/{roleAssignmentId}:
delete:
description: Unassigns a Role Assignment (identified by `roleAssignmentId`)
from a Group (identified by the `groupId`)
operationId: unassignRoleFromGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign a Group Role
tags:
- RoleAssignmentBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a Role assigned to a Group (identified by the `groupId`).
The `roleAssignmentId` is the unique identifier for either a standard role
Group Assignment object or a custom role Resource Set Binding object.
operationId: getGroupAssignedRole
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Standard Roles:
$ref: '#/components/examples/CreateStandardRoleAssignmentResponseGroup'
Custom Roles:
$ref: '#/components/examples/CreateCustomRoleResponseGroup'
IAM-based Standard Roles:
$ref: '#/components/examples/CreateIAMStandardRoleResponseGroup'
schema:
$ref: '#/components/schemas/listGroupAssignedRoles_200_response_inner'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a Group Role Assignment
tags:
- RoleAssignmentBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/catalog/apps:
get:
description: "Lists all app targets for an `APP_ADMIN` Role Assignment to a\
\ Group. The response includes a list of OIN-cataloged apps or app instances.\
\ The response payload for an app instance contains the `id` property, but\
\ an OIN-cataloged app doesn't."
operationId: listApplicationTargetsForApplicationAdministratorRoleForGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/CatalogApplication'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Group Role Application Targets
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}:
delete:
description: |
Unassigns an OIN app target from an `APP_ADMIN` Role Assignment to a Group
> **Note:** You can't remove the last app target from a Role Assignment, since this causes an exception.
> If you need a Role Assignment that applies to all apps, delete the `APP_ADMIN` Role Assignment and recreate a new one. See [Unassign a Group Role](/openapi/okta-management/management/tag/RoleAssignmentBGroup/#tag/RoleAssignmentBGroup/operation/unassignRoleFromGroup).
operationId: unassignAppTargetToAdminRoleForGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign a Group Role Application Target
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: "Assigns an OIN app target to an `APP_ADMIN` Role Assignment to\
\ a Group. When you assign the first OIN app target, you reduce the scope\
\ of the Role Assignment. The Role no longer applies to all app targets but\
\ applies only to the specified target. An OIN app target that's assigned\
\ to the Role overrides any existing instance targets of the OIN app. For\
\ example, if a user is assigned to administer a specific Facebook instance,\
\ a successful request to add an OIN app with `facebook` for `appName` makes\
\ that user the administrator for all Facebook instances."
operationId: assignAppTargetToAdminRoleForGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
responses:
"200":
content: {}
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign an Group Role Application Target
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}:
delete:
description: |-
Unassigns an app instance target from an `APP_ADMIN` Role Assignment to a Group
> **Note:** You can't remove the last app instance target from a Role Assignment since this causes an exception. > If you need a Role Assignment that applies to all apps, delete the `APP_ADMIN` Role Assignment and recreate a new one. See [Unassign a Group Role](/openapi/okta-management/management/tag/RoleAssignmentBGroup/#tag/RoleAssignmentBGroup/operation/unassignRoleFromGroup).
operationId: unassignAppInstanceTargetToAppAdminRoleForGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign an Group Role Application Instance Target
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |-
Assigns an app instance target to an `APP_ADMIN` Role Assignment to a Group. When you assign the first OIN app or app instance target, you reduce the scope of the Role Assignment. The Role no longer applies to all app targets, but applies only to the specified target.
> **Note:** You can target a mixture of both OIN app and app instance targets, but you can't assign permissions to manage all instances of an OIN app and then assign a subset of permissions to the same app. For example, you can't specify that an admin has access to manage all instances of the Salesforce app and then also manage specific configurations of the Salesforce app.
operationId: assignAppInstanceTargetToAppAdminRoleForGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign an Group Role Application Instance Target
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/groups:
get:
description: |
Lists all Group targets for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` Role Assignment to a Group.
If the Role isn't scoped to specific Group targets, an empty array `[]` is returned.
operationId: listGroupTargetsForGroupRole
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/Group'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Group Role Group Targets
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/roles/{roleAssignmentId}/targets/groups/{targetGroupId}:
delete:
description: "Unassigns a Group target from a `USER_ADMIN`, `HELP_DESK_ADMIN`,\
\ or `GROUP_MEMBERSHIP_ADMIN` Role Assignment to a Group."
operationId: unassignGroupTargetFromGroupAdminRole
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- explode: false
in: path
name: targetGroupId
required: true
schema:
example: 00g1e9dfjHeLAsdX983d
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign a Group Role Group Target
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |
Assigns a Group target to a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` Role Assignment to a Group.
When you assign the first Group target, you reduce the scope of the Role Assignment. The Role no longer applies to all targets but applies only to the specified target.
operationId: assignGroupTargetToGroupAdminRole
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- explode: false
in: path
name: targetGroupId
required: true
schema:
example: 00g1e9dfjHeLAsdX983d
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign a Group Role Group Target
tags:
- RoleBTargetBGroup
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/users:
get:
description: |-
Lists all users that are a member of a Group.
The default user limit is set to a very high number due to historical reasons that are no longer valid for most orgs. This will change in a future version of this API. The recommended page limit is now `limit=200`.
operationId: listGroupUsers
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of user results in a page
explode: true
in: query
name: limit
required: false
schema:
default: 1000
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
ListMemberUserResponse:
$ref: '#/components/examples/ListUsersResponse'
schema:
items:
$ref: '#/components/schemas/User'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.read
summary: List all Member Users
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/groups/{groupId}/users/{userId}:
delete:
description: |-
Unassigns a User from a Group with the `OKTA_GROUP` type
> **Note:** You only can modify memberships for groups of the `OKTA_GROUP` type.
>
> App imports are responsible for managing group memberships for groups of the `APP_GROUP` type, such as Active Directory groups.
operationId: unassignUserFromGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Unassign a User from a Group
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |-
Assigns a User to a Group with the `OKTA_GROUP` type
> **Note:** You only can modify memberships for Groups of the `OKTA_GROUP` type. App imports are responsible for managing group memberships for Groups of the `APP_GROUP` type, such as Active Directory groups.
operationId: assignUserToGroup
parameters:
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.groups.manage
summary: Assign a User to a Group
tags:
- Group
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/hook-keys:
get:
description: Lists all keys
operationId: listHookKeys
responses:
"200":
content:
application/json:
examples:
ResponseExample:
$ref: '#/components/examples/ListAllKeysResponse'
schema:
items:
$ref: '#/components/schemas/HookKey'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.read
summary: List all keys
tags:
- HookKey
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a key for use with other parts of the application, such as inline hooks
> **Note:** Use the key name to access this key for inline hook operations.
The total number of keys that you can create in an Okta org is limited to 50.
operationId: createHookKey
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/KeyRequest'
required: true
responses:
"200":
content:
application/json:
examples:
ResponseExample:
$ref: '#/components/examples/CreateHookKeyResponse'
schema:
$ref: '#/components/schemas/DetailedHookKeyInstance'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Create a key
tags:
- HookKey
x-codegen-request-body-name: keyRequest
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/hook-keys/public/{keyId}:
get:
description: |-
Retrieves a public key by `keyId`
>**Note:** keyId is the alias of the public key.
operationId: getPublicKey
parameters:
- description: id" of the Public Key
explode: false
in: path
name: keyId
required: true
schema:
example: FcH2P9Eg7wr0o8N2FuV0
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
ResponseExample:
$ref: '#/components/examples/RetrievePublicKeyResponse'
schema:
$ref: '#/components/schemas/_embedded'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.read
summary: Retrieve a public key
tags:
- HookKey
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/hook-keys/{id}:
delete:
description: |
Deletes a key by `id`. After being deleted, the key is unrecoverable.
As a safety precaution, only keys that aren't being used are eligible for deletion.
operationId: deleteHookKey
parameters:
- description: ID of the Hook Key
explode: false
in: path
name: id
required: true
schema:
example: XreKU5laGwBkjOTehusG
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Delete a key
tags:
- HookKey
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: |-
Retrieves the public portion of the Key object using the `id` parameter
>**Note:** The `?expand=publickey` query parameter optionally returns the full object including the details of the public key in the response body's `_embedded` property.
operationId: getHookKey
parameters:
- description: ID of the Hook Key
explode: false
in: path
name: id
required: true
schema:
example: XreKU5laGwBkjOTehusG
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
ResponseExample:
$ref: '#/components/examples/RetrieveKeyResponse'
schema:
$ref: '#/components/schemas/HookKey'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.read
summary: Retrieve a key by ID
tags:
- HookKey
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |-
Replaces a key by `id`
This request replaces existing properties after passing validation.
> **Note:** The only parameter that you can update is the name of the key, which must be unique at all times.
operationId: replaceHookKey
parameters:
- description: ID of the Hook Key
explode: false
in: path
name: id
required: true
schema:
example: XreKU5laGwBkjOTehusG
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/KeyRequest'
required: true
responses:
"200":
content:
application/json:
examples:
ResponseExample:
$ref: '#/components/examples/ReplaceKeyResponse'
schema:
$ref: '#/components/schemas/DetailedHookKeyInstance'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Replace a key
tags:
- HookKey
x-codegen-request-body-name: keyRequest
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/assignees/users:
get:
description: Lists all users with Role Assignments
operationId: listUsersWithRoleAssignments
parameters:
- description: Specifies the pagination cursor for the next page of targets
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of results returned. Defaults to `100`.
explode: true
in: query
name: limit
required: false
schema:
default: 100
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
User List:
$ref: '#/components/examples/RoleAssignedUsersResponseExample'
schema:
$ref: '#/components/schemas/RoleAssignedUsers'
description: Success
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Users with Role Assignments
tags:
- RoleAssignmentAUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/iam/resource-sets:
get:
description: Lists all Resource Sets with pagination support
operationId: listResourceSets
parameters:
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetsResponse'
schema:
$ref: '#/components/schemas/ResourceSets'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Resource Sets
tags:
- RoleCResourceSet
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a new Resource Set. See [Supported Resources](/openapi/okta-management/guides/roles/#supported-resources).
> **Note:** The maximum number of `resources` allowed in a Resource Set object is 1000. Resources are identified by either an Okta Resource Name (ORN) or by a REST URL format. See [Okta Resource Name](/openapi/okta-management/guides/roles/#okta-resource-name-orn).
operationId: createResourceSet
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/ResourceSetRequest'
schema:
$ref: '#/components/schemas/CreateResourceSetRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetResponse'
schema:
$ref: '#/components/schemas/ResourceSet'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Create a Resource Set
tags:
- RoleCResourceSet
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}:
delete:
description: Deletes a Resource Set by `resourceSetIdOrLabel`
operationId: deleteResourceSet
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Delete a Resource Set
tags:
- RoleCResourceSet
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a Resource Set by `resourceSetIdOrLabel`
operationId: getResourceSet
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetResponse'
schema:
$ref: '#/components/schemas/ResourceSet'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a Resource Set
tags:
- RoleCResourceSet
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces the label and description of a Resource Set
operationId: replaceResourceSet
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/ReplaceResourceSetRequest'
schema:
$ref: '#/components/schemas/ResourceSet'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetResponse'
schema:
$ref: '#/components/schemas/ResourceSet'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Replace a Resource Set
tags:
- RoleCResourceSet
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings:
get:
description: Lists all Bindings for a Resource Set with pagination support
operationId: listBindings
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetBindingsResponse'
schema:
$ref: '#/components/schemas/ResourceSetBindings'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Role Resource Set Bindings
tags:
- RoleDResourceSetBinding
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: "Creates a Binding for the Resource Set, Custom Role, and members\
\ (Users or Groups)"
operationId: createResourceSetBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/ResourceSetBindingCreateRequestExample'
schema:
$ref: '#/components/schemas/ResourceSetBindingCreateRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetBindingResponseExample'
schema:
$ref: '#/components/schemas/ResourceSetBindingResponse'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Create a Role Resource Set Binding
tags:
- RoleDResourceSetBinding
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings/{roleIdOrLabel}:
delete:
description: Deletes a Binding of a Role (identified by `roleIdOrLabel`) and
a Resource Set (identified by `resourceSetIdOrLabel`)
operationId: deleteBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Delete a Role Resource Set Binding
tags:
- RoleDResourceSetBinding
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves the Binding of a Role (identified by `roleIdOrLabel`)
in a Resource Set (identified by `resourceSetIdOrLabel`)
operationId: getBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetBindingResponseWithIdExample'
schema:
$ref: '#/components/schemas/ResourceSetBindingResponse'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a Role Resource Set Binding
tags:
- RoleDResourceSetBinding
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings/{roleIdOrLabel}/members:
get:
description: Lists all members of a Role Resource Set Binding with pagination
support
operationId: listMembersOfBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetBindingMembersResponse'
schema:
$ref: '#/components/schemas/ResourceSetBindingMembers'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Role Resource Set Binding Members
tags:
- RoleDResourceSetBindingMember
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
patch:
description: Adds more members to a Role Resource Set Binding
operationId: addMembersToBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/ResourceSetBindingAddMembersRequestExample'
schema:
$ref: '#/components/schemas/ResourceSetBindingAddMembersRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetBindingResponseExample'
schema:
$ref: '#/components/schemas/ResourceSetBindingResponse'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Add more Role Resource Set Binding Members
tags:
- RoleDResourceSetBindingMember
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}/bindings/{roleIdOrLabel}/members/{memberId}:
delete:
description: Unassigns a Member (identified by `memberId`) from a Role Resource
Set Binding
operationId: unassignMemberFromBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: '`id` of the Member'
explode: false
in: path
name: memberId
required: true
schema:
example: irb1qe6PGuMc7Oh8N0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign a Role Resource Set Bindiing Member
tags:
- RoleDResourceSetBindingMember
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a Member (identified by `memberId`) that belongs to a
Role Resource Set Binding
operationId: getMemberOfBinding
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: '`id` of the Member'
explode: false
in: path
name: memberId
required: true
schema:
example: irb1qe6PGuMc7Oh8N0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetBindingMemberResponse'
schema:
$ref: '#/components/schemas/ResourceSetBindingMember'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a Role Resource Set Binding Member
tags:
- RoleDResourceSetBindingMember
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}/resources:
get:
description: Lists all Resources for the Resource Set
operationId: listResourceSetResources
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetResourcesResponse'
schema:
$ref: '#/components/schemas/ResourceSetResources'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Resource Set Resources
tags:
- RoleCResourceSetResource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
patch:
description: Adds more Resources to a Resource Set
operationId: addResourceSetResources
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/ResourceSetResourcePatchRequestExample'
schema:
$ref: '#/components/schemas/ResourceSetResourcePatchRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/ResourceSetResponse'
schema:
$ref: '#/components/schemas/ResourceSet'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Add more Resources to a Resource Set
tags:
- RoleCResourceSetResource
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/resource-sets/{resourceSetIdOrLabel}/resources/{resourceId}:
delete:
description: Deletes a Resource (identified by `resourceId`) from a Resource
Set
operationId: deleteResourceSetResource
parameters:
- description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
- description: '`id` of the Resource'
explode: false
in: path
name: resourceId
required: true
schema:
example: ire106sQKoHoXXsAe0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Delete a Resource Set Resource
tags:
- RoleCResourceSetResource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/iam/roles:
get:
description: Lists all Custom Roles with pagination support
operationId: listRoles
parameters:
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/RolesResponse'
schema:
$ref: '#/components/schemas/IamRoles'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Custom Roles
tags:
- RoleECustom
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Creates a Custom Role
operationId: createRole
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/RoleRequest'
schema:
$ref: '#/components/schemas/CreateIamRoleRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/RoleResponse'
schema:
$ref: '#/components/schemas/IamRole'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Create a Custom Role
tags:
- RoleECustom
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/roles/{roleIdOrLabel}:
delete:
description: Deletes a Custom Role by `roleIdOrLabel`
operationId: deleteRole
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Delete a Custom Role
tags:
- RoleECustom
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a role by `roleIdOrLabel`
operationId: getRole
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/RoleResponse'
schema:
$ref: '#/components/schemas/IamRole'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a Role
tags:
- RoleECustom
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces the label and description for a Custom Role by `roleIdOrLabel`
operationId: replaceRole
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request:
$ref: '#/components/examples/ReplaceRoleRequest'
schema:
$ref: '#/components/schemas/UpdateIamRoleRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/RoleResponse'
schema:
$ref: '#/components/schemas/IamRole'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Replace a Custom Role
tags:
- RoleECustom
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/iam/roles/{roleIdOrLabel}/permissions:
get:
description: Lists all permissions for a Custom Role by `roleIdOrLabel`
operationId: listRolePermissions
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/PermissionsResponse'
schema:
$ref: '#/components/schemas/Permissions'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Custom Role Permissions
tags:
- RoleECustomPermission
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/iam/roles/{roleIdOrLabel}/permissions/{permissionType}:
delete:
description: Deletes a permission (identified by `permissionType`) from a Custom
Role
operationId: deleteRolePermission
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: An okta permission type
explode: false
in: path
name: permissionType
required: true
schema:
example: okta.users.manage
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Delete a Custom Role Permission
tags:
- RoleECustomPermission
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a permission (identified by `permissionType`) for a Custom
Role
operationId: getRolePermission
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: An okta permission type
explode: false
in: path
name: permissionType
required: true
schema:
example: okta.users.manage
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Example Response without conditions:
$ref: '#/components/examples/PermissionResponse'
Example Response with conditions:
$ref: '#/components/examples/PermissionResponseWithConditions'
schema:
$ref: '#/components/schemas/Permission'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a Custom Role Permission
tags:
- RoleECustomPermission
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Creates a permission (specified by `permissionType`) for a Custom
Role
operationId: createRolePermission
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: An okta permission type
explode: false
in: path
name: permissionType
required: true
schema:
example: okta.users.manage
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request with include:
$ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithInclude'
Example Request with exclude:
$ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithExclude'
schema:
$ref: '#/components/schemas/CreateUpdateIamRolePermissionRequest'
required: false
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
responses:
"204":
description: No Content
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Create a Custom Role Permission
tags:
- RoleECustomPermission
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
put:
description: Replaces a permission (specified by `permissionType`) for a Custom
Role
operationId: replaceRolePermission
parameters:
- description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
- description: An okta permission type
explode: false
in: path
name: permissionType
required: true
schema:
example: okta.users.manage
type: string
style: simple
requestBody:
content:
application/json:
examples:
Example Request with include:
$ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithInclude'
Example Request with exclude:
$ref: '#/components/examples/CreateUpdateIamRolePermissionRequestExampleWithExclude'
schema:
$ref: '#/components/schemas/CreateUpdateIamRolePermissionRequest'
required: false
responses:
"200":
content:
application/json:
examples:
Example Response:
$ref: '#/components/examples/PermissionResponseWithConditions'
schema:
$ref: '#/components/schemas/Permission'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Replace a Custom Role Permission
tags:
- RoleECustomPermission
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-codegen-request-body-name: instance
x-content-type: application/json
x-accepts:
- application/json
/api/v1/identity-sources/{identitySourceId}/sessions:
get:
description: Lists all Identity Source Sessions for the given Identity Source
instance
operationId: listIdentitySourceSessions
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
sessionsList:
$ref: '#/components/examples/ListSessionsResponseForGetSessions'
schema:
items:
$ref: '#/components/schemas/IdentitySourceSession'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.read
summary: List all Identity Source Sessions
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
post:
description: Creates an Identity Source Session for the given Identity Source
instance
operationId: createIdentitySourceSession
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
session:
$ref: '#/components/examples/GetSessionResponse'
schema:
$ref: '#/components/schemas/IdentitySourceSession'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.manage
summary: Create an Identity Source Session
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}:
delete:
description: Deletes an Identity Source Session for a given `identitySourceId`
and `sessionId`
operationId: deleteIdentitySourceSession
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
- description: The ID of the Identity Source Session
example: aps1qqonvr2SZv6o70h8
explode: false
in: path
name: sessionId
required: true
schema:
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.manage
summary: Delete an Identity Source Session
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
get:
description: Retrieves an Identity Source Session for a given Identity Source
ID and session ID
operationId: getIdentitySourceSession
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
- description: The ID of the Identity Source Session
example: aps1qqonvr2SZv6o70h8
explode: false
in: path
name: sessionId
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
session:
$ref: '#/components/examples/GetSessionResponse'
schema:
$ref: '#/components/schemas/IdentitySourceSession'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.read
summary: Retrieve an Identity Source Session
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-delete:
post:
description: Uploads external IDs of entities that need to be deleted in Okta
from the Identity Source for the given session
operationId: uploadIdentitySourceDataForDelete
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
- description: The ID of the Identity Source Session
example: aps1qqonvr2SZv6o70h8
explode: false
in: path
name: sessionId
required: true
schema:
type: string
style: simple
requestBody:
content:
application/json:
examples:
bulkDeletePayload:
$ref: '#/components/examples/bulkDeletePayload'
schema:
$ref: '#/components/schemas/BulkDeleteRequestBody'
responses:
"202":
description: Accepted
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.manage
summary: Upload the data to be deleted in Okta
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/bulk-upsert:
post:
description: Uploads entities that need to be inserted or updated in Okta from
the Identity Source for the given session
operationId: uploadIdentitySourceDataForUpsert
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
- description: The ID of the Identity Source Session
example: aps1qqonvr2SZv6o70h8
explode: false
in: path
name: sessionId
required: true
schema:
type: string
style: simple
requestBody:
content:
application/json:
examples:
bulkUpsertPayload:
$ref: '#/components/examples/bulkUpsertPayload'
schema:
$ref: '#/components/schemas/BulkUpsertRequestBody'
responses:
"202":
description: Accepted
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.manage
summary: Upload the data to be upserted in Okta
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/identity-sources/{identitySourceId}/sessions/{sessionId}/start-import:
post:
description: Starts the import from the Identity Source described by the uploaded
bulk operations
operationId: startImportFromIdentitySource
parameters:
- description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
- description: The ID of the Identity Source Session
example: aps1qqonvr2SZv6o70h8
explode: false
in: path
name: sessionId
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
triggeredSession:
$ref: '#/components/examples/TriggerSessionResponse'
schema:
$ref: '#/components/schemas/IdentitySourceSession'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.identitySources.manage
summary: Start the import from the Identity Source
tags:
- IdentitySource
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/idps:
get:
description: Lists all identity provider integrations with pagination. A subset
of IdPs can be returned that match a supported filter expression or query.
operationId: listIdentityProviders
parameters:
- description: Searches the `name` property of IdPs for matching value
example: Example SAML
explode: true
in: query
name: q
required: false
schema:
type: string
style: form
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: A limit on the number of objects to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
minimum: 1
type: integer
style: form
- description: Filters IdPs by `type`
explode: true
in: query
name: type
required: false
schema:
$ref: '#/components/schemas/IdentityProviderType'
style: form
responses:
"200":
content:
application/json:
examples:
MultipleIdPsResponse:
$ref: '#/components/examples/MultipleIdPsResponse'
schema:
items:
$ref: '#/components/schemas/IdentityProvider'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: List all Identity Providers
tags:
- IdentityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: "Creates a new Identity Provider integration.\n\n#### SAML 2.0\
\ Identity Provider\n\nYou must first add the IdP's signature certificate\
\ to the IdP key store before you can add a SAML 2.0 IdP with a `kid` credential\
\ reference. \n\nDon't use `fromURI` to automatically redirect a user to a\
\ particular app after successfully authenticating with a third-party IdP.\
\ Instead, use SAML deep links. Using `fromURI` isn't tested or supported.\
\ For more information about using deep links when signing users in using\
\ an SP-initiated flow, see [Understanding SP-Initiated Login flow](https://developer.okta.com/docs/concepts/saml/#understanding-sp-initiated-login-flow).\n\
\nUse SAML deep links to automatically redirect the user to an app after successfully\
\ authenticating with a third-party IdP. To use deep links, assemble these\
\ three parts into a URL:\n\n* SP ACS URL
\nFor example: `https://${yourOktaDomain}/sso/saml2/:idpId`\n\
* The app to which the user is automatically redirected after successfully\
\ authenticating with the IdP
\nFor example: `/app/:app-location/:appId/sso/saml`\n\
* Optionally, if the app is an outbound SAML app, you can specify the `relayState`\
\ passed to it.
\nFor example: `?RelayState=:anyUrlEncodedValue`\n\nThe\
\ deep link for the above three parts is:
\n`https://${yourOktaDomain}/sso/saml2/:idpId/app/:app-location/:appId/sso/saml?RelayState=:anyUrlEncodedValue`\n\
\n#### Smart Card X509 Identity Provider\n\nYou must first add the IdP's server\
\ certificate to the IdP key store before you can add a Smart Card `X509`\
\ IdP with a `kid` credential reference. \nYou need to upload the whole trust\
\ chain as a single key using the [Key Store API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderKeys/#tag/IdentityProviderKeys/operation/createIdentityProviderKey).\n\
Depending on the information stored in the smart card, select the proper [template](https://developer.okta.com/docs/reference/okta-expression-language/#idp-user-profile)\
\ `idpuser.subjectAltNameEmail` or `idpuser.subjectAltNameUpn`."
operationId: createIdentityProvider
requestBody:
content:
application/json:
examples:
CreateGenericOidcIdPRequest:
$ref: '#/components/examples/CreateGenericOidcIdPRequest'
CreateSamlIdPRequest:
$ref: '#/components/examples/CreateSamlIdPRequest'
CreateAppleIdPRequest:
$ref: '#/components/examples/CreateAppleIdPRequest'
CreateFacebookIdPRequest:
$ref: '#/components/examples/CreateFacebookIdPRequest'
CreateGoogleIdPRequest:
$ref: '#/components/examples/CreateGoogleIdPRequest'
CreateMicrosoftIdPRequest:
$ref: '#/components/examples/CreateMicrosoftIdPRequest'
CreateSmartCardIdPRequest:
$ref: '#/components/examples/CreateSmartCardIdPRequest'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: IdP settings
required: true
responses:
"200":
content:
application/json:
examples:
CreateGenericOidcIdpResponse:
$ref: '#/components/examples/GenericOidcIdpResponse'
CreateSamlIdPResponse:
$ref: '#/components/examples/SamlIdPResponse'
CreateAppleIdPResponse:
$ref: '#/components/examples/AppleIdPResponse'
CreateFacebookIdPResponse:
$ref: '#/components/examples/FacebookIdPResponse'
CreateGoogleIdPResponse:
$ref: '#/components/examples/GoogleIdPResponse'
CreateMicrosoftIdPResponse:
$ref: '#/components/examples/MicrosoftIdPResponse'
CreateSmartCardIdPResponse:
$ref: '#/components/examples/SmartCardIdPResponse'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Create an Identity Provider
tags:
- IdentityProvider
x-codegen-request-body-name: identityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/idps/credentials/keys:
get:
description: Lists all IdP Key Credentials
operationId: listIdentityProviderKeys
parameters:
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: A limit on the number of objects to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
minimum: 1
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
ListIdPKeyCredentialsResponse:
$ref: '#/components/examples/MultipleIdPKeyCredentialsResponse'
schema:
items:
$ref: '#/components/schemas/IdPKeyCredential'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: List all IdP Key Credentials
tags:
- IdentityProviderKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a new X.509 certificate credential in the IdP key store
> **Note:** RSA-based certificates are supported for all IdP types. Okta currently supports EC-based certificates only for the `X509` IdP type. For EC-based certificates we support only P-256, P-384, and P-521 curves.
operationId: createIdentityProviderKey
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/IdPCertificateCredential'
required: true
responses:
"200":
content:
application/json:
examples:
IdPKeyCredentialResponse:
$ref: '#/components/examples/IdPKeyCredentialResponse'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Create an IdP Key Credential
tags:
- IdentityProviderKeys
x-codegen-request-body-name: jsonWebKey
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/idps/credentials/keys/{kid}:
delete:
description: Deletes a specific IdP Key Credential by `kid` if it isn't currently
being used by an active or inactive IdP
operationId: deleteIdentityProviderKey
parameters:
- description: Unique `id` of the IdP Key Credential
explode: false
in: path
name: kid
required: true
schema:
example: KmMo85SSsU7TZzOShcGb
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Delete an IdP Key Credential
tags:
- IdentityProviderKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a specific IdP Key Credential by `kid`
operationId: getIdentityProviderKey
parameters:
- description: Unique `id` of the IdP Key Credential
explode: false
in: path
name: kid
required: true
schema:
example: KmMo85SSsU7TZzOShcGb
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
IdPKeyCredentialResponse:
$ref: '#/components/examples/IdPKeyCredentialResponse'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: Retrieve an IdP Key Credential
tags:
- IdentityProviderKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces an IdP Key Credential by `kid`
operationId: replaceIdentityProviderKey
parameters:
- description: Unique `id` of the IdP Key Credential
explode: false
in: path
name: kid
required: true
schema:
example: KmMo85SSsU7TZzOShcGb
type: string
style: simple
requestBody:
content:
application/json:
examples:
IdPKeyCredentialRequest:
$ref: '#/components/examples/IdPKeyCredentialRequest'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Updated IdP Key Credential
required: true
responses:
"200":
content:
application/json:
examples:
IdPKeyCredentialResponse:
$ref: '#/components/examples/IdPKeyCredentialResponse'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Replace an IdP Key Credential
tags:
- IdentityProviderKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/idps/{idpId}:
delete:
description: |-
Deletes an identity provider integration by `idpId`
* All existing IdP users are unlinked with the highest order profile source taking precedence for each IdP user.
* Unlinked users keep their existing authentication provider such as `FEDERATION` or `SOCIAL`.
operationId: deleteIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Delete an Identity Provider
tags:
- IdentityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves an identity provider integration by `idpId`
operationId: getIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
GenericOidcIdpResponse:
$ref: '#/components/examples/GenericOidcIdpResponse'
SamlIdPResponse:
$ref: '#/components/examples/SamlIdPResponse'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: Retrieve an Identity Provider
tags:
- IdentityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces an identity provider integration by `idpId`
operationId: replaceIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
requestBody:
content:
application/json:
examples:
ReplaceIdPRequest:
$ref: '#/components/examples/ReplaceIdPRequestResponse'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: Updated configuration for the IdP
required: true
responses:
"200":
content:
application/json:
examples:
ReplaceIdPResponse:
$ref: '#/components/examples/ReplaceIdPRequestResponse'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Replace an Identity Provider
tags:
- IdentityProvider
x-codegen-request-body-name: identityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/idps/{idpId}/credentials/csrs:
get:
description: Lists all Certificate Signing Requests for an IdP
operationId: listCsrsForIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
MultipleIdPCsrsResponse:
$ref: '#/components/examples/MultipleIdPCsrsResponse'
schema:
items:
$ref: '#/components/schemas/IdPCsr'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: List all Certificate Signing Requests
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Generates a new key pair and returns a Certificate Signing Request (CSR) for it
> **Note:** The private key isn't listed in the [Signing Key Credentials for IdP](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProviderSigningKeys/#tag/IdentityProviderSigningKeys/operation/listIdentityProviderSigningKeys) until it's published.
operationId: generateCsrForIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/CsrMetadata'
required: true
responses:
"201":
content:
application/json:
examples:
CsrJsonResponse:
$ref: '#/components/examples/CsrJsonResponse'
schema:
$ref: '#/components/schemas/IdPCsr'
application/pkcs10:
examples:
CsrPkcs10Response:
$ref: '#/components/examples/CsrPkcs10Response'
schema:
$ref: '#/components/schemas/IdPCsrPkcs10'
description: Created
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Generate a Certificate Signing Request
tags:
- IdentityProviderSigningKeys
x-codegen-request-body-name: metadata
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
- application/pkcs10
/api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}:
delete:
description: Revokes a CSR and deletes the key pair from the IdP
operationId: revokeCsrForIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: '`id` of the IdP CSR'
explode: false
in: path
name: idpCsrId
required: true
schema:
example: 1uEhyE65oV3H6KM9gYcN
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Revoke a Certificate Signing Request
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a specific Certificate Signing Request by `id`
operationId: getCsrForIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: '`id` of the IdP CSR'
explode: false
in: path
name: idpCsrId
required: true
schema:
example: 1uEhyE65oV3H6KM9gYcN
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
CsrJsonResponse:
$ref: '#/components/examples/CsrJsonResponse'
schema:
$ref: '#/components/schemas/IdPCsr'
application/pkcs10:
examples:
CsrPkcs10Response:
$ref: '#/components/examples/CsrPkcs10Response'
schema:
$ref: '#/components/schemas/IdPCsrPkcs10'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: Retrieve a Certificate Signing Request
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
- application/pkcs10
/api/v1/idps/{idpId}/credentials/csrs/{idpCsrId}/lifecycle/publish:
post:
description: |-
Publishes the CSR with a signed X.509 certificate and adds it into the signing Key Credentials for the IdP
> **Notes:**
> * Publishing a certificate completes the lifecycle of the CSR, and it's no longer accessible.
> * If the validity period of the certificate is less than 90 days, a 400 error response is returned.
operationId: publishCsrForIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: '`id` of the IdP CSR'
explode: false
in: path
name: idpCsrId
required: true
schema:
example: 1uEhyE65oV3H6KM9gYcN
type: string
style: simple
requestBody:
content:
application/pkix-cert:
schema:
description: "X.509 certificate in `DER` format. \nThe client can either\
\ post in binary or Base64URL-encoded. If the post is Base64URL-encoded,\
\ set the `Content-Transfer-Encoding` header to `base64`."
example: !!binary |-
TUlJRmdqQ0NBMnFnQXdJQkFnSUNFQWN3RFFZSktvWklodmNOQVFFTEJRQXdYakVMTUFrR0ExVUVC
aE1DVlZNeEN6QUpCZ05WQkFnTUFrTkJNUll3RkFZRFZRUUhEQTFUWVc0Z1JuSmhibU5wYzJOdk1R
MHdDd1lEVlFRS0RBUlBhM1JoTVF3d0NnWURWUVFMREFORmJtY3hEVEFMQmdOVkJBTU1CRkp2YjNR
d0hoY05NVGN3TXpJM01qRXlNRFEzV2hjTk1UZ3dOREEyTWpFeU1EUTNXakI0TVFzd0NRWURWUVFH
RXdKVlV6RVRNQkVHQTFVRUNBd0tRMkZzYVdadmNtNXBZVEVXTUJRR0ExVUVCd3dOVTJGdUlFWnlZ
VzVqYVhOamJ6RVRNQkVHQTFVRUNnd0tUMnQwWVN3Z1NXNWpMakVRTUE0R0ExVUVDd3dIU21GdWEz
bERiekVWTUJNR0ExVUVBd3dNU1dSUUlFbHpjM1ZsY2lBM01JSUJJakFOQmdrcWhraUc5dzBCQVFF
RkFBT0NBUThBTUlJQkNnS0NBUUVBbWtDNnlBSlZ2RndVbG1NOWdLamIyZCtZSzVxSEZ0K21YU3Ni
aldLS3M0RWZObStCb1FlZW92Qlp0U0FDeWFxTGM4SVlGVFBFVVJGY2JEUTlEa0FMMDR1VUlSRDJn
YUhZWTd1SzBqc2x1RWFYR3EyUkFJc216QXdOVHpraUR3NHE5cERML3E3bjBmL1NEdDFUc01hTVFh
eUI2YlU1aldzbXFjV0o4TUNSSjFhSk1qWjE2dW41VVZ4NTFJSWVDYmU0UVJEeEVYR0F2WU5jenNC
b1p4c3BEdDI4ZXNTcHE1VzBkQkZ4Y3lHVnVkeWw1NEVyM0Z6QWd1aGdmTVZqSCtiVWVjOWoyVGw0
MHFEVGt0cllnWWZ4ejlwZmptMDFIbDRXWVAxWVF4ZUVUcFNMN2NRNUloejRqR0R0SFVFT2NaNEdm
SnJQenJHcFVyYWs4UXA1eGN3Q3FRSURBUUFCbzRJQkxqQ0NBU293Q1FZRFZSMFRCQUl3QURBUkJn
bGdoa2dCaHZoQ0FRRUVCQU1DQmtBd013WUpZSVpJQVliNFFnRU5CQ1lXSkU5d1pXNVRVMHdnUjJW
dVpYSmhkR1ZrSUZObGNuWmxjaUJEWlhKMGFXWnBZMkYwWlRBZEJnTlZIUTRFRmdRVVZxSnVrRG15
RU53LzJwVEFwYnhjL0hSS2JuZ3dnWkFHQTFVZEl3U0JpRENCaFlBVUZ4MjQ1WlpYcVdUVGJBUmZN
bEZXTjc3TDlFYWhZcVJnTUY0eEN6QUpCZ05WQkFZVEFsVlRNUXN3Q1FZRFZRUUlEQUpEUVRFV01C
UUdBMVVFQnd3TlUyRnVJRVp5WVc1amFYTmpiekVOTUFzR0ExVUVDZ3dFVDJ0MFlURU1NQW9HQTFV
RUN3d0RSVzVuTVEwd0N3WURWUVFEREFSU2IyOTBnZ2tBbElmcHdaak81bzh3RGdZRFZSMFBBUUgv
QkFRREFnV2dNQk1HQTFVZEpRUU1NQW9HQ0NzR0FRVUZCd01CTUEwR0NTcUdTSWIzRFFFQkN3VUFB
NElDQVFDY29CU1J0WSs5Y0pZMDBoTHZxNkFsb1laY2RuL2tVUXVwZm15ejRuM2xLRTN3VjJGQjBz
d0tuSzBRRGk4aU51UUpGZGFnLzE5dkRIQzQvTGhvU3V2MVErS1hNNjFwUFpWUlhYUHlDMStlN1k2
aGo5M3RFSTVIY3FMUGNEUkgxQUlHMmw4dEU3TEJuK01RQjVWaDZveGpHMklkb1d4ZzZhYk1mSVNV
K01hdVBXcWw0dk1EVVdvOWlOU2hBbzQ0WjVmZCtudXoraGxBaW5VOVhuOUpmMlFzZkt2Y2JNUnE3
aXVxZ2thYmdkbU9ibVdiOUtLMFZtN1REa3hDSDBwQjBvblByNmVwVlVQOE9iZy9wVDFPai8xaE9M
YmZSOENISFdkQVd6VUJHR3ZwMlRJeTJBOExVYUVvRm53a3haZmRMN0JuZDBSSC9DbEJ0QWp6TE94
bVVvN05iWm1FbllDY0Q1cFp6N0JkWkkwZGIvZUJYRnFmT2xBODhyRWUrOVN2K05uZElxMC9XTklJ
c0ppMlJnakpueHN4dkI1TWpoaHptSXRwRklVbDV5cW9PM0M5amNDcDZIREJKeHRDR2J2QXI1QUxQ
bjVSQ0plQklyNjdXcEFpVGQ3TDNFYnU5U1FabFhub0hYOGtQMDRFQTZ5bFIzVzBFRmJoN0tVdHE4
TTJIMnZvMHdqTWo3eXNsLzN0VDdjRVo5N3MxeWdPNWlKeDNHZk1EeXJEaHRMWFNCSjIwdVN4VEpl
cHRSdzhTRGl3VHF1bkloMVd5S2xjUXoxV0dhdVNiVzRlWGRqL3I5S1lNSjNxTU1rZFAvOVRIUVV0
VGNPWXg1MXI4UlY5cGR6cUYySFBuWlpOemlCYSt3WEpaSEVXcDcwTnlvYWtOdGhnWXd0eXBxaURI
czJmM1E9PQ==
format: binary
type: string
x-okta-operationId: publishBinaryDerCertForIdentityProvider
application/x-x509-ca-cert:
schema:
description: |-
X.509 certificate in `CER` format.
The client can either post in binary or Base64URL-encoded. If the post is Base64URL-encoded, set the `Content-Transfer-Encoding` header to `base64`.
example: !!binary |-
QGNlcnRpZmljYXRlLmNlcg==
format: binary
type: string
x-okta-operationId: publishBinaryCerCertForIdentityProvider
application/x-pem-file:
schema:
description: X.509 certificate in `PEM` format
example: !!binary |-
QGNlcnRpZmljYXRlLnBlbQ==
format: binary
type: string
x-okta-operationId: publishBinaryPemCertForIdentityProvider
required: true
responses:
"201":
content:
application/json:
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Created
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Publish a Certificate Signing Request
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/pkix-cert
x-accepts:
- application/json
/api/v1/idps/{idpId}/credentials/keys:
get:
description: Lists all signing Key Credentials for an IdP
operationId: listIdentityProviderSigningKeys
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
MultipleIdPSigningKeyCredentialsResponse:
$ref: '#/components/examples/MultipleIdPSigningKeyCredentialsResponse'
schema:
items:
$ref: '#/components/schemas/IdPKeyCredential'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: List all signing Key Credentials for IdP
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/credentials/keys/generate:
post:
description: |-
Generates a new X.509 certificate for an IdP signing Key Credential to be used for signing assertions sent to the IdP. IdP signing keys are read-only.
> **Note:** To update an IdP with the newly generated Key Credential, [update your IdP](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider) using the returned key's `kid` in the [signing credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/credentials/signing/kid&t=request).
operationId: generateIdentityProviderSigningKey
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: expiry of the IdP Key Credential
explode: true
in: query
name: validityYears
required: true
schema:
format: int32
maximum: 10
minimum: 2
type: integer
style: form
responses:
"200":
content:
application/json:
examples:
IdPSigningKeyCredentialResponse:
$ref: '#/components/examples/IdPSigningKeyCredentialResponse'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Generate a new signing Key Credential for IdP
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/credentials/keys/{kid}:
get:
description: Retrieves a specific IdP Key Credential by `kid`
operationId: getIdentityProviderSigningKey
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: Unique `id` of the IdP Key Credential
explode: false
in: path
name: kid
required: true
schema:
example: KmMo85SSsU7TZzOShcGb
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
IdPSigningKeyCredentialResponse:
$ref: '#/components/examples/IdPSigningKeyCredentialResponse'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: Retrieve a signing Key Credential for IdP
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/credentials/keys/{kid}/clone:
post:
description: |-
Clones an X.509 certificate for an IdP signing Key Credential from a source IdP to target IdP
> **Caution:** Sharing certificates isn't a recommended security practice.
> **Note:** If the key is already present in the list of Key Credentials for the target IdP, you receive a 400 error response.
operationId: cloneIdentityProviderKey
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: Unique `id` of the IdP Key Credential
explode: false
in: path
name: kid
required: true
schema:
example: KmMo85SSsU7TZzOShcGb
type: string
style: simple
- description: '`id` of the target IdP'
explode: true
in: query
name: targetIdpId
required: true
schema:
type: string
style: form
responses:
"201":
content:
application/json:
examples:
IdPSigningKeyCredentialResponse:
$ref: '#/components/examples/IdPSigningKeyCredentialResponse'
schema:
$ref: '#/components/schemas/IdPKeyCredential'
description: Created
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Clone a signing Key Credential for IdP
tags:
- IdentityProviderSigningKeys
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/lifecycle/activate:
post:
description: Activates an inactive IdP
operationId: activateIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
ActivateIdPResponse:
$ref: '#/components/examples/ActivateIdPResponse'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Activate an Identity Provider
tags:
- IdentityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/lifecycle/deactivate:
post:
description: Deactivates an active IdP
operationId: deactivateIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
DeactivateIdPResponse:
$ref: '#/components/examples/DeactivateIdPResponse'
schema:
$ref: '#/components/schemas/IdentityProvider'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Deactivate an Identity Provider
tags:
- IdentityProvider
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/users:
get:
description: Lists all the Users linked to an Identity Provider
operationId: listIdentityProviderApplicationUsers
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: Searches the records for matching value
explode: true
in: query
name: q
required: false
schema:
type: string
style: form
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: A limit on the number of objects to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
minimum: 1
type: integer
style: form
- description: Expand user data
explode: true
in: query
name: expand
required: false
schema:
example: user
type: string
style: form
responses:
"200":
content:
application/json:
examples:
ListIdPUsersResponse:
$ref: '#/components/examples/ListIdPUsersResponse'
schema:
items:
$ref: '#/components/schemas/IdentityProviderApplicationUser'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: List all Users for IdP
tags:
- IdentityProviderUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/idps/{idpId}/users/{userId}:
delete:
description: "Unlinks the Okta User and the IdP User. The next time the User\
\ federates into Okta through this IdP, they have to re-link their account\
\ according to the account link policy."
operationId: unlinkUserFromIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.manage
summary: Unlink a User from IdP
tags:
- IdentityProviderUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a linked IdP User by ID
operationId: getIdentityProviderApplicationUser
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
IdPAppUserResponse:
$ref: '#/components/examples/IdPAppUserResponse'
schema:
$ref: '#/components/schemas/IdentityProviderApplicationUser'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: Retrieve a User for IdP
tags:
- IdentityProviderUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: "Links an Okta User to an existing SAML or social Identity Provider.\
\ \n\nThe SAML Identity Provider must have `honorPersistentNameId` set to\
\ `true` to use this API. \nThe [Name Identifier Format](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/replaceIdentityProvider!path=protocol/0/settings&t=request)\
\ of the incoming assertion must be `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`."
operationId: linkUserToIdentityProvider
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/UserIdentityProviderLinkRequest'
required: true
responses:
"200":
content:
application/json:
examples:
LinkIdPAppUserResponse:
$ref: '#/components/examples/LinkIdPAppUserResponse'
schema:
$ref: '#/components/schemas/IdentityProviderApplicationUser'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Link a User to IdP
tags:
- IdentityProviderUsers
x-codegen-request-body-name: userIdentityProviderLinkRequest
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/idps/{idpId}/users/{userId}/credentials/tokens:
get:
description: |-
Lists the tokens minted by the Social Authentication Provider when the user authenticates with Okta via Social Auth.
Okta doesn't import all the User information from a social provider. If the app needs information that isn't imported, it can get the User token from this endpoint. Then the app can make an API call to the social provider with the token to request the additional information.
operationId: listSocialAuthTokens
parameters:
- description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
SocialAuthTokensResponse:
$ref: '#/components/examples/SocialAuthTokensResponse'
schema:
items:
$ref: '#/components/schemas/SocialAuthToken'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.idps.read
summary: List all Tokens from OIDC IdP
tags:
- IdentityProviderUsers
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/inlineHooks:
get:
description: Lists all inline hooks
operationId: listInlineHooks
parameters:
- explode: true
in: query
name: type
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
AuthenticatorConfiguration:
$ref: '#/components/examples/InlineHookTelephony'
schema:
items:
$ref: '#/components/schemas/InlineHook'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.read
summary: List all Inline Hooks
tags:
- InlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Creates an inline hook
operationId: createInlineHook
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Create an Inline Hook
tags:
- InlineHook
x-codegen-request-body-name: inlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/inlineHooks/{inlineHookId}:
delete:
description: "Deletes an inline hook by `inlineHookId`. Once deleted, the Inline\
\ Hook is unrecoverable. As a safety precaution, only Inline Hooks with a\
\ status of INACTIVE are eligible for deletion."
operationId: deleteInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Delete an Inline Hook
tags:
- InlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves an inline hook by `inlineHookId`
operationId: getInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
AuthenticatorConfiguration:
$ref: '#/components/examples/InlineHookTelephony'
schema:
$ref: '#/components/schemas/InlineHook'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.read
summary: Retrieve an Inline Hook
tags:
- InlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Updates an inline hook by `inlineHookId`
operationId: updateInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Update an Inline Hook
tags:
- InlineHook
x-codegen-request-body-name: inlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
put:
description: Replaces an inline hook by `inlineHookId`
operationId: replaceInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Replace an Inline Hook
tags:
- InlineHook
x-codegen-request-body-name: inlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/inlineHooks/{inlineHookId}/execute:
post:
description: Executes the inline hook by `inlineHookId` using the request body
as the input. This will send the provided data through the Channel and return
a response if it matches the correct data contract. This execution endpoint
should only be used for testing purposes.
operationId: executeInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHookPayload'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHookResponse'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Execute an Inline Hook
tags:
- InlineHook
x-codegen-request-body-name: payloadData
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/inlineHooks/{inlineHookId}/lifecycle/activate:
post:
description: Activates the inline hook by `inlineHookId`
operationId: activateInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Activate an Inline Hook
tags:
- InlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/inlineHooks/{inlineHookId}/lifecycle/deactivate:
post:
description: Deactivates the inline hook by `inlineHookId`
operationId: deactivateInlineHook
parameters:
- description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/InlineHook'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.inlineHooks.manage
summary: Deactivate an Inline Hook
tags:
- InlineHook
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/logStreams:
get:
description: Lists all Log Stream objects in your org. You can request a paginated
list or a subset of Log Streams that match a supported filter expression.
operationId: listLogStreams
parameters:
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: A limit on the number of objects to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
minimum: 1
type: integer
style: form
- description: "An expression that [filters](/#filter) the returned objects.\
\ You can only use the `eq` operator on either the `status` or `type` properties\
\ in the filter expression."
explode: true
in: query
name: filter
required: false
schema:
example: type eq "aws_eventbridge"
type: string
style: form
responses:
"200":
content:
application/json:
examples:
ExampleGetAllResponse:
$ref: '#/components/examples/LogStreamGetAllResponse'
schema:
items:
$ref: '#/components/schemas/LogStream'
type: array
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.read
summary: List all Log Streams
tags:
- LogStream
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
post:
description: Creates a new Log Stream object
operationId: createLogStream
requestBody:
content:
application/json:
examples:
LogStreamPostRequestExample:
$ref: '#/components/examples/LogStreamPostRequest'
schema:
$ref: '#/components/schemas/LogStream'
required: true
responses:
"200":
content:
application/json:
examples:
LogStreamPostResponseExample:
$ref: '#/components/examples/LogStreamPostResponse'
schema:
$ref: '#/components/schemas/LogStream'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.manage
summary: Create a Log Stream
tags:
- LogStream
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/logStreams/{logStreamId}:
delete:
description: Deletes a Log Stream object from your org by ID
operationId: deleteLogStream
parameters:
- description: Unique identifier for the Log Stream
explode: false
in: path
name: logStreamId
required: true
schema:
example: 0oa1orzg0CHSgPcjZ0g4
type: string
style: simple
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
Access Denied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.manage
summary: Delete a Log Stream
tags:
- LogStream
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
get:
description: Retrieves a Log Stream object by ID
operationId: getLogStream
parameters:
- description: Unique identifier for the Log Stream
explode: false
in: path
name: logStreamId
required: true
schema:
example: 0oa1orzg0CHSgPcjZ0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
LogStreamGetRequestExample:
$ref: '#/components/examples/LogStreamPostResponse'
schema:
$ref: '#/components/schemas/LogStream'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.read
summary: Retrieve a Log Stream
tags:
- LogStream
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
put:
description: |-
Replaces the Log Stream object properties for a given ID.
This operation is typically used to update the configuration of a Log Stream.
Depending on the type of Log Stream you want to update, certain properties can't be modified after the Log Stream is initially created.
Use the [Retrieve the Log Stream Schema for the schema type](/openapi/okta-management/management/tag/Schema/#tag/Schema/operation/getLogStreamSchema) request to determine which properties you can update for the specific Log Stream type.
Log Stream properties with the `"writeOnce" : true` attribute can't be updated after creation.
You must still specify these `writeOnce` properties in the request body with the original values in the PUT request.
> **Note:** You don't have to specify properties that have both the `"writeOnce": true` and the `"writeOnly": true` attributes in the PUT request body. These property values are ignored even if you add them in the PUT request body.
operationId: replaceLogStream
parameters:
- description: Unique identifier for the Log Stream
explode: false
in: path
name: logStreamId
required: true
schema:
example: 0oa1orzg0CHSgPcjZ0g4
type: string
style: simple
requestBody:
content:
application/json:
examples:
LogStreamPutRequestExample:
$ref: '#/components/examples/LogStreamPutRequest'
schema:
$ref: '#/components/schemas/LogStreamPutSchema'
required: true
responses:
"200":
content:
application/json:
examples:
LogStreamPostResponseExample:
$ref: '#/components/examples/LogStreamPutResponse'
schema:
$ref: '#/components/schemas/LogStream'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.manage
summary: Replace a Log Stream
tags:
- LogStream
x-codegen-request-body-name: instance
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/logStreams/{logStreamId}/lifecycle/activate:
post:
description: Activates a log stream by `logStreamId`
operationId: activateLogStream
parameters:
- description: Unique identifier for the Log Stream
explode: false
in: path
name: logStreamId
required: true
schema:
example: 0oa1orzg0CHSgPcjZ0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
LogStreamActivateResponseExample:
$ref: '#/components/examples/LogStreamActivateResponse'
schema:
$ref: '#/components/schemas/LogStream'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.manage
summary: Activate a Log Stream
tags:
- LogStream
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/logStreams/{logStreamId}/lifecycle/deactivate:
post:
description: Deactivates a log stream by `logStreamId`
operationId: deactivateLogStream
parameters:
- description: Unique identifier for the Log Stream
explode: false
in: path
name: logStreamId
required: true
schema:
example: 0oa1orzg0CHSgPcjZ0g4
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
LogStreamDeactivateResponseExample:
$ref: '#/components/examples/LogStreamDeactivateResponse'
schema:
$ref: '#/components/schemas/LogStream'
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.manage
summary: Deactivate a Log Stream
tags:
- LogStream
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/logs:
get:
description: Lists all System Log Events
operationId: listLogEvents
parameters:
- description: Filters the lower time bound of the log events `published` property
for bounded queries or persistence time for polling queries
explode: true
in: query
name: since
required: false
schema:
default: 7 days prior to until
format: ISO 8601 compliant timestamp
type: string
style: form
- description: Filters the upper time bound of the log events `published` property
for bounded queries or persistence time for polling queries.
explode: true
in: query
name: until
required: false
schema:
default: current time
format: ISO 8601 compliant timestamp
type: string
style: form
- description: Retrieves the next page of results. Okta returns a link in the
HTTP Header (`rel=next`) that includes the after query parameter
explode: true
in: query
name: after
required: false
schema:
format: Opaque token
type: string
style: form
- description: "Filter expression that filters the results. All operators except\
\ [ ] are supported. See [Filter](https://developer.okta.com/docs/api/#filter)."
explode: true
in: query
name: filter
required: false
schema:
format: SCIM Filter expression
type: string
style: form
- description: Filters log events results by one or more case insensitive keywords.
explode: true
in: query
name: q
required: false
schema:
format: "URL encoded string. Max length is 40 characters per keyword, with\
\ a maximum of 10 keyword filters per query (before encoding)"
type: string
style: form
- description: Sets the number of results that are returned in the response
explode: true
in: query
name: limit
required: false
schema:
default: 100
format: Integer between 0 and 1000
type: integer
style: form
- description: The order of the returned events that are sorted by the `published`
property
explode: true
in: query
name: sortOrder
required: false
schema:
default: ASCENDING
enum:
- ASCENDING
- DESCENDING
type: string
style: form
responses:
"200":
content:
application/json:
examples:
ListLogs:
$ref: '#/components/examples/ListLogs'
LogTargetChangeDetails:
$ref: '#/components/examples/LogTargetChangeDetails'
schema:
items:
$ref: '#/components/schemas/LogEvent'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logs.read
summary: List all System Log Events
tags:
- SystemLog
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/mappings:
get:
description: |-
Lists all profile mappings in your organization with [pagination](https://developer.okta.com/docs/api/#pagination). You can return a subset of profile mappings that match a supported `sourceId` and/or `targetId`.
The results are [paginated](/#pagination) according to the limit parameter. If there are multiple pages of results, the Link header contains a `next` link that should be treated as an opaque value (follow it, don't parse it).
The response is a collection of profile mappings that include a subset of the profile mapping object's parameters. The profile mapping object describes
the properties mapping between an Okta User and an App User Profile using [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04).
operationId: listProfileMappings
parameters:
- description: Mapping `id` that specifies the pagination cursor for the next
page of mappings
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of results per page (maximum 200)
explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
type: integer
style: form
- description: "The UserType or App Instance `id` that acts as the source of\
\ expressions in a mapping. If this parameter is included, all returned\
\ mappings have this as their `source.id`."
explode: true
in: query
name: sourceId
required: false
schema:
type: string
style: form
- description: "The UserType or App Instance `id` that acts as the target of\
\ expressions in a mapping. If this parameter is included, all returned\
\ mappings have this as their `target.id`."
explode: true
in: query
name: targetId
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
MappingList:
$ref: '#/components/examples/ListMappingsResponse'
schema:
items:
$ref: '#/components/schemas/ListProfileMappings'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.profileMappings.read
summary: List all Profile Mappings
tags:
- ProfileMapping
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/mappings/{mappingId}:
get:
description: Retrieves a single Profile Mapping referenced by its ID
operationId: getProfileMapping
parameters:
- description: '`id` of the Mapping'
explode: false
in: path
name: mappingId
required: true
schema:
example: cB6u7X8mptebWkffatKA
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
MappingRetrieve:
$ref: '#/components/examples/RetrieveMappingsResponse'
schema:
$ref: '#/components/schemas/ProfileMapping'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.profileMappings.read
summary: Retrieve a Profile Mapping
tags:
- ProfileMapping
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
post:
description: "Updates an existing profile mapping by adding, updating, or removing\
\ one or many property mappings"
operationId: updateProfileMapping
parameters:
- description: '`id` of the Mapping'
explode: false
in: path
name: mappingId
required: true
schema:
example: cB6u7X8mptebWkffatKA
type: string
style: simple
requestBody:
content:
application/json:
examples:
Addpropertymapping:
$ref: '#/components/examples/AddMappingBody'
Updatepropertymapping:
$ref: '#/components/examples/UpdateMappingBody'
Removepropertymapping:
$ref: '#/components/examples/RemoveMappingBody'
schema:
$ref: '#/components/schemas/ProfileMappingRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Addpropertymapping:
$ref: '#/components/examples/AddMappingResponse'
Updatepropertymapping:
$ref: '#/components/examples/UpdateMappingResponse'
Removepropertymapping:
$ref: '#/components/examples/RemoveMappingResponse'
schema:
$ref: '#/components/schemas/ProfileMapping'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.profileMappings.manage
summary: Update a Profile Mapping
tags:
- ProfileMapping
x-codegen-request-body-name: profileMapping
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/layouts/apps/{appName}: {}
/api/v1/meta/layouts/apps/{appName}/sections/{section}/{operation}: {}
/api/v1/meta/schemas/apps/{appId}/default:
get:
description: |-
Retrieves the default Schema for an App User.
The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to apps. All users assigned to a given app use the same App User Schema. Therefore, unlike the User Schema operations, the App User Schema operations all specify `default` and don't accept a Schema ID.
operationId: getApplicationUserSchema
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/UserSchema'
description: successful operation
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.schemas.read
summary: Retrieve the default App User Schema for an App
tags:
- Schema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Updates the App User Schema. This updates, adds, or removes one or more custom profile properties or the nullability of a base property in the App User Schema for an app. Changing a base property's nullability (for example, the value of its `required` field) is allowed only if it is nullable in the default predefined Schema for the App.
The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to apps. All users assigned to a given app use the same App User Schema. Therefore, unlike the User Schema operations, the App User Schema operations all specify `default` and don't accept a Schema ID.
operationId: updateApplicationUserProfile
parameters:
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
requestBody:
content:
application/json:
examples:
Add a custom property to the app user schema:
$ref: '#/components/examples/AppUserSchemaAddRequest'
schema:
$ref: '#/components/schemas/UserSchema'
required: false
responses:
"200":
content:
application/json:
examples:
Response with a subset of properties for brevity:
$ref: '#/components/examples/AppUserSchemaResponse'
schema:
$ref: '#/components/schemas/UserSchema'
description: successful operation
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.schemas.manage
summary: Update the App User Profile Schema for an App
tags:
- Schema
x-codegen-request-body-name: body
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/schemas/group/default:
get:
description: |-
Retrieves the Group Schema
The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to groups. All groups use the same Group Schema. Unlike User Schema operations, Group Schema operations all specify `default` and don't accept a Schema ID.
operationId: getGroupSchema
parameters: []
responses:
"200":
content:
application/json:
examples:
Response with a subset of properties for brevity:
$ref: '#/components/examples/GroupSchemaResponse'
schema:
$ref: '#/components/schemas/GroupSchema'
description: successful operation
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.schemas.read
summary: Retrieve the default Group Schema
tags:
- Schema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Updates the Group Profile schema. This updates, adds, or removes one or more custom profile properties in a Group Schema. Currently Okta does not support changing base Group Profile properties.
The [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature does not extend to groups. All groups use the same Group Schema. Unlike User Schema operations, Group Schema operations all specify `default` and don't accept a Schema ID.
**Note:** Since POST is interpreted as a partial update, you must set properties explicitly to null to remove them from the Schema.
operationId: updateGroupSchema
requestBody:
content:
application/json:
examples:
Add a custom property to the group schema:
$ref: '#/components/examples/GroupSchemaAddRequest'
schema:
$ref: '#/components/schemas/GroupSchema'
responses:
"200":
content:
application/json:
example:
Response with a subset of properties for brevity:
$ref: '#/components/examples/GroupSchemaResponse'
schema:
$ref: '#/components/schemas/GroupSchema'
description: successful operation
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.schemas.manage
summary: Update the Group Profile Schema
tags:
- Schema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/schemas/logStream:
get:
description: Lists the Schema for all Log Stream types visible for this org
operationId: listLogStreamSchemas
responses:
"200":
content:
application/json:
examples:
All log stream schemas for your org:
$ref: '#/components/examples/LogStreamSchemaList'
schema:
items:
$ref: '#/components/schemas/LogStreamSchema'
type: array
description: successful operation
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.read
summary: List the Log Stream Schemas
tags:
- Schema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/meta/schemas/logStream/{logStreamType}:
get:
description: "Retrieves the Schema for a Log Stream type. The `logStreamType`\
\ element in the URL specifies the Log Stream type, which is either `aws_eventbridge`\
\ or `splunk_cloud_logstreaming`. Use the `aws_eventbridge` literal to retrieve\
\ the AWS EventBridge type schema, and use the `splunk_cloud_logstreaming`\
\ literal retrieve the Splunk Cloud type schema."
operationId: getLogStreamSchema
parameters:
- explode: false
in: path
name: logStreamType
required: true
schema:
$ref: '#/components/schemas/LogStreamType'
style: simple
responses:
"200":
content:
application/json:
examples:
Schema for type `aws_eventbridge`:
$ref: '#/components/examples/LogStreamSchemaAws'
Schema for type `splunk_cloud_logstreaming`:
$ref: '#/components/examples/LogStreamSchemaSplunk'
schema:
$ref: '#/components/schemas/LogStreamSchema'
description: successful operation
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.logStreams.read
summary: Retrieve the Log Stream Schema for the schema type
tags:
- Schema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/meta/schemas/user/linkedObjects:
get:
description: Lists all Linked Object definitions
operationId: listLinkedObjectDefinitions
responses:
"200":
content:
application/json:
examples:
ListLinkedObjectsEx:
$ref: '#/components/examples/ListLinkedObjects'
schema:
items:
$ref: '#/components/schemas/LinkedObject'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.linkedObjects.read
summary: List all Linked Object Definitions
tags:
- LinkedObject
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Creates a Linked Object definition
operationId: createLinkedObjectDefinition
requestBody:
content:
application/json:
examples:
CreateLinkedObjectRequestEx:
$ref: '#/components/examples/CreateLinkedObjectRequest'
schema:
$ref: '#/components/schemas/LinkedObject'
required: true
responses:
"201":
content:
application/json:
examples:
CreateLinkedObjectResponseEx:
$ref: '#/components/examples/CreateLinkedObjectResponse'
schema:
$ref: '#/components/schemas/LinkedObject'
description: Created
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"409":
content:
application/json:
examples:
ErrorInvalidLinkedObjectDefEx:
$ref: '#/components/examples/ErrorInvalidLinkedObjectDef'
schema:
$ref: '#/components/schemas/Error'
description: Conflict
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.linkedObjects.manage
summary: Create a Linked Object Definition
tags:
- LinkedObject
x-codegen-request-body-name: linkedObject
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/schemas/user/linkedObjects/{linkedObjectName}:
delete:
description: "Deletes the Linked Object definition specified by either the `primary`\
\ or `associated` name. The entire definition is removed, regardless of which\
\ name that you specify."
operationId: deleteLinkedObjectDefinition
parameters:
- description: Primary or Associated name
explode: false
in: path
name: linkedObjectName
required: true
schema:
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.linkedObjects.manage
summary: Delete a Linked Object Definition
tags:
- LinkedObject
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a Linked Object definition
operationId: getLinkedObjectDefinition
parameters:
- description: Primary or Associated name
explode: false
in: path
name: linkedObjectName
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
CreateLinkedObjectResponseEx:
$ref: '#/components/examples/CreateLinkedObjectResponse'
schema:
$ref: '#/components/schemas/LinkedObject'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.linkedObjects.read
summary: Retrieve a Linked Object Definition
tags:
- LinkedObject
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/meta/schemas/user/{schemaId}:
get:
description: Retrieves the Schema for a User Type
operationId: getUserSchema
parameters:
- explode: false
in: path
name: schemaId
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Response with a subset of properties for brevity:
$ref: '#/components/examples/UserSchemaResponse'
schema:
$ref: '#/components/schemas/UserSchema'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.schemas.read
summary: Retrieve a User Schema
tags:
- Schema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: "Updates a User Schema. This updates, adds, or removes one or more\
\ profile properties in a User Schema. \n\nUnlike custom User Profile properties,\
\ limited changes are allowed to base User Profile properties (permissions,\
\ nullability of the `firstName` and `lastName` properties, or pattern for\
\ `login`). A property cannot be removed from the default Schema if it is\
\ being referenced as a [matchAttribute](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/)\
\ in SAML2 IdPs. Currently, all validation of SAML assertions is only performed\
\ against the default user type."
operationId: updateUserProfile
parameters:
- explode: false
in: path
name: schemaId
required: true
schema:
type: string
style: simple
requestBody:
content:
application/json:
examples:
Add a custom property to the user schema:
$ref: '#/components/examples/UserSchemaAddRequest'
schema:
$ref: '#/components/schemas/UserSchema'
required: true
responses:
"200":
content:
application/json:
examples:
Response with a subset of properties for brevity:
$ref: '#/components/examples/UserSchemaResponse'
schema:
$ref: '#/components/schemas/UserSchema'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.schemas.manage
summary: Update a User Schema
tags:
- Schema
x-codegen-request-body-name: userSchema
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/types/user:
get:
description: Lists all User Types in your org
operationId: listUserTypes
responses:
"200":
content:
application/json:
examples:
ListsAllUserTypes:
$ref: '#/components/examples/ListsAllUserTypes'
schema:
items:
$ref: '#/components/schemas/UserType'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.userTypes.read
summary: List all User Types
tags:
- UserType
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a new User Type. Okta automatically creates a `default` User Type for your org. You may add up to nine additional User Types.
> **Note**: New User Types are based on the current default schema template. Modifications to this schema do not automatically propagate to previously created User Types.
operationId: createUserType
requestBody:
content:
application/json:
examples:
CreateUserRequest:
$ref: '#/components/examples/CreateUserRequest'
schema:
$ref: '#/components/schemas/CreateUserTypeRequest'
required: true
responses:
"200":
content:
application/json:
examples:
CreateUserResponse:
$ref: '#/components/examples/CreateUserResponse'
schema:
$ref: '#/components/schemas/UserType'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.userTypes.manage
summary: Create a User Type
tags:
- UserType
x-codegen-request-body-name: userType
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/types/user/{typeId}:
delete:
description: |-
Deletes a User Type permanently.
> **Note**: You can't delete the default User Type or a User Type that is currently assigned to users.
operationId: deleteUserType
parameters:
- explode: false
in: path
name: typeId
required: true
schema:
description: The unique key for the User Type
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.userTypes.manage
summary: Delete a User Type
tags:
- UserType
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a User Type by ID. Use `default` to fetch the default
User Type.
operationId: getUserType
parameters:
- explode: false
in: path
name: typeId
required: true
schema:
description: The unique key for the User Type
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
GetUserResponse:
$ref: '#/components/examples/GetUserResponse'
schema:
$ref: '#/components/schemas/UserType'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.userTypes.read
summary: Retrieve a User Type
tags:
- UserType
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Updates an existing User Type. This operation is a partial update.
> **Note**: You can only update the `displayName` and `description` elements. The `name` of an existing User Type can't be changed.
operationId: updateUserType
parameters:
- explode: false
in: path
name: typeId
required: true
schema:
description: The unique key for the User Type
type: string
style: simple
requestBody:
content:
application/json:
examples:
UpdateUserTypePostRequest:
$ref: '#/components/examples/UpdateUserTypePostRequest'
schema:
$ref: '#/components/schemas/UserTypePostRequest'
required: true
responses:
"200":
content:
application/json:
examples:
UpdateUserTypePutRequest:
$ref: '#/components/examples/UpdateUserTypePostResponse'
schema:
$ref: '#/components/schemas/UserType'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.userTypes.manage
summary: Update a User Type
tags:
- UserType
x-codegen-request-body-name: userType
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
put:
description: |-
Replaces an existing User Type. This operation is a full update.
> **Note**: The `name` of an existing User Type can't be changed, but must be part of the request body. You can only replace the `displayName` and `description` elements.
operationId: replaceUserType
parameters:
- explode: false
in: path
name: typeId
required: true
schema:
description: The unique key for the User Type
type: string
style: simple
requestBody:
content:
application/json:
examples:
ReplaceUserTypePutRequest:
$ref: '#/components/examples/ReplaceUserTypePutRequest'
schema:
$ref: '#/components/schemas/UserTypePutRequest'
responses:
"200":
content:
application/json:
examples:
ReplaceUserTypePutResponse:
$ref: '#/components/examples/ReplaceUserTypePutResponse'
schema:
$ref: '#/components/schemas/UserType'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.userTypes.manage
summary: Replace a User Type
tags:
- UserType
x-codegen-request-body-name: userType
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/uischemas:
get:
description: Lists all UI Schemas in your org
operationId: listUISchemas
responses:
"200":
content:
application/json:
examples:
UIISchemaList:
$ref: '#/components/examples/ListUISchemaResponse'
schema:
items:
$ref: '#/components/schemas/UISchemasResponseObject'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.uischemas.read
summary: List all UI Schemas
tags:
- UISchema
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
post:
description: Creates an input for an enrollment form
operationId: createUISchema
requestBody:
content:
application/json:
examples:
UISchemaCreate:
$ref: '#/components/examples/CreateUISchemaBody'
schema:
$ref: '#/components/schemas/CreateUISchema'
required: true
responses:
"200":
content:
application/json:
examples:
UISchemaCreate:
$ref: '#/components/examples/CreateUISchemaResponse'
schema:
$ref: '#/components/schemas/UISchemasResponseObject'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.uischemas.manage
summary: Create a UI Schema
tags:
- UISchema
x-codegen-request-body-name: uischemabody
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/meta/uischemas/{id}:
delete:
description: Deletes a UI Schema by `id`
operationId: deleteUISchemas
parameters:
- description: The unique ID of the UI Schema
explode: false
in: path
name: id
required: true
schema:
example: uis4a7liocgcRgcxZ0g7
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.uischemas.manage
summary: Delete a UI Schema
tags:
- UISchema
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
get:
description: Retrieves a UI Schema by `id`
operationId: getUISchema
parameters:
- description: The unique ID of the UI Schema
explode: false
in: path
name: id
required: true
schema:
example: uis4a7liocgcRgcxZ0g7
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
UISchemaRetrieve:
$ref: '#/components/examples/RetrieveUISchemaResponse'
schema:
$ref: '#/components/schemas/UISchemasResponseObject'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.uischemas.read
summary: Retrieve a UI Schema
tags:
- UISchema
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
put:
description: Replaces a UI Schema by `id`
operationId: replaceUISchemas
parameters:
- description: The unique ID of the UI Schema
explode: false
in: path
name: id
required: true
schema:
example: uis4a7liocgcRgcxZ0g7
type: string
style: simple
requestBody:
content:
application/json:
examples:
UISchemaPUT:
$ref: '#/components/examples/CreateUISchemaBody'
schema:
$ref: '#/components/schemas/UpdateUISchema'
required: true
responses:
"200":
content:
application/json:
examples:
UISchemaUpdate:
$ref: '#/components/examples/CreateUISchemaResponse'
schema:
$ref: '#/components/schemas/UISchemasResponseObject'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.uischemas.manage
summary: Replace a UI Schema
tags:
- UISchema
x-codegen-request-body-name: updateUISchemaBody
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org:
get:
description: Retrieves the Org General Settings
operationId: getOrgSettings
parameters: []
responses:
"200":
content:
application/json:
examples:
example-1:
$ref: '#/components/examples/OrgSettingResponse'
schema:
$ref: '#/components/schemas/OrgSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Org General Settings
tags:
- OrgSettingGeneral
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Updates partial Org General Settings
operationId: updateOrgSettings
requestBody:
content:
application/json:
examples:
example-1:
$ref: '#/components/examples/UpdateOrgSettingEx'
schema:
$ref: '#/components/schemas/OrgSetting'
responses:
"200":
content:
application/json:
examples:
example-1:
$ref: '#/components/examples/OrgSettingResponse'
schema:
$ref: '#/components/schemas/OrgSetting'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Update the Org General Settings
tags:
- OrgSettingGeneral
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
put:
description: Replaces the Org General Settings for your Okta org
operationId: replaceOrgSettings
requestBody:
content:
application/json:
examples:
example-1:
$ref: '#/components/examples/UpdateOrgSettingEx'
schema:
$ref: '#/components/schemas/OrgSetting'
required: true
responses:
"200":
content:
application/json:
examples:
example-1:
$ref: '#/components/examples/OrgSettingResponse'
schema:
$ref: '#/components/schemas/OrgSetting'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Replace the Org General Settings
tags:
- OrgSettingGeneral
x-codegen-request-body-name: orgSetting
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/captcha:
delete:
description: Deletes the CAPTCHA settings object for your organization
operationId: deleteOrgCaptchaSettings
responses:
"204":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.captchas.manage
summary: Delete the Org-wide CAPTCHA Settings
tags:
- CAPTCHA
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
get:
description: |-
Retrieves the CAPTCHA settings object for your organization
> **Note**: If the current organization hasn't configured CAPTCHA Settings, the request returns an empty object.
operationId: getOrgCaptchaSettings
responses:
"200":
content:
application/json:
examples:
configured:
$ref: '#/components/examples/OrgCAPTCHASettingsConfigured'
empty:
$ref: '#/components/examples/OrgCAPTCHASettingsEmpty'
schema:
$ref: '#/components/schemas/OrgCAPTCHASettings'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.captchas.read
summary: Retrieve the Org-wide CAPTCHA Settings
tags:
- CAPTCHA
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-accepts:
- application/json
put:
description: |-
Replaces the CAPTCHA settings object for your organization
> **Note**: You can disable CAPTCHA for your organization by setting `captchaId` and `enabledPages` to `null`.
operationId: replacesOrgCaptchaSettings
requestBody:
content:
application/json:
examples:
Update:
$ref: '#/components/examples/OrgCAPTCHASettingsUpdate'
Disable:
$ref: '#/components/examples/OrgCAPTCHASettingsDisable'
schema:
$ref: '#/components/schemas/OrgCAPTCHASettings'
required: true
responses:
"200":
content:
application/json:
examples:
Update:
$ref: '#/components/examples/OrgCAPTCHASettingsUpdated'
Disable:
$ref: '#/components/examples/OrgCAPTCHASettingsDisabled'
schema:
$ref: '#/components/schemas/OrgCAPTCHASettings'
description: Success
"400":
content:
application/json:
examples:
NoDisable:
$ref: '#/components/examples/ErrorCAPTCHAOrgWideSettingNull'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.captchas.manage
summary: Replace the Org-wide CAPTCHA Settings
tags:
- CAPTCHA
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/contacts:
get:
description: Lists all Org Contact Types for your Okta org
operationId: listOrgContactTypes
parameters: []
responses:
"200":
content:
application/json:
examples:
orgContactTypeEx:
$ref: '#/components/examples/orgContactTypeResponse'
schema:
items:
$ref: '#/components/schemas/OrgContactTypeObj'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: List all Org Contact Types
tags:
- OrgSettingContact
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/contacts/{contactType}:
get:
description: Retrieves the ID and the User resource associated with the specified
Contact Type
operationId: getOrgContactUser
parameters:
- explode: false
in: path
name: contactType
required: true
schema:
description: Type of contact
enum:
- BILLING
- TECHNICAL
example: BILLING
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
contactTypeUserEx:
$ref: '#/components/examples/orgContactUserResponse'
schema:
$ref: '#/components/schemas/OrgContactUser'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Contact Type User
tags:
- OrgSettingContact
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Replaces the User associated with the specified Contact Type
operationId: replaceOrgContactUser
parameters:
- explode: false
in: path
name: contactType
required: true
schema:
description: Type of contact
enum:
- BILLING
- TECHNICAL
example: BILLING
type: string
style: simple
requestBody:
content:
application/json:
examples:
contactTypeUserEx:
summary: Contact User
value:
userId: 00ux3u0ujW1r5AfZC1d7
schema:
$ref: '#/components/schemas/OrgContactUser'
required: true
responses:
"200":
content:
application/json:
examples:
contactTypeUserEx:
$ref: '#/components/examples/orgContactUserResponse'
schema:
$ref: '#/components/schemas/OrgContactUser'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Replace the Contact Type User
tags:
- OrgSettingContact
x-codegen-request-body-name: orgContactUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/email/bounces/remove-list:
post:
description: |
Removes emails from an email service bounce list.
The emails submitted in this operation are removed from the bounce list by an asynchronous job.
Any email address that passes validation is accepted for the removal process, even if there are other email addresses in the request that failed validation.
> **Note:** If there are validation errors for all email addresses, a `200 OK` HTTP status is still returned.
operationId: bulkRemoveEmailAddressBounces
requestBody:
content:
application/json:
examples:
example-1:
summary: Request example
value:
emailAddresses:
- [email protected]
- [email protected]
- name@okta@com
schema:
$ref: '#/components/schemas/BouncesRemoveListObj'
responses:
"200":
content:
application/json:
examples:
example-1:
summary: Response example
value:
errors:
- emailAddress: [email protected]
reason: This email address does not belong to any user in your
organization.
- emailAddress: name@okta@com
reason: Invalid email address. The provided email address failed
validation against RFC 3696.
schema:
$ref: '#/components/schemas/BouncesRemoveListResult'
description: OK
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Remove Bounced Emails
tags:
- EmailCustomization
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/factors/yubikey_token/tokens:
get:
description: Lists all YubiKey OTP Tokens
operationId: listYubikeyOtpTokens
parameters:
- description: Specifies the pagination cursor for the next page of tokens
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: "Embeds the [User](/openapi/okta-management/management/tag/User/)\
\ resource if the YubiKey Token is assigned to a user and `expand` is set\
\ to `user`"
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
- description: The expression used to filter tokens
explode: true
in: query
name: filter
required: false
schema:
enum:
- profile.email
- profile.serial
- activated
- user.id
- created
- status
- lastVerified
type: string
style: form
- description: "Returns tokens in a CSV to download instead of in the response.\
\ When you use this query parameter, the `limit` default changes to 1000."
explode: true
in: query
name: forDownload
required: false
schema:
default: false
type: boolean
style: form
- description: Specifies the number of results per page
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
type: integer
style: form
- description: The value of how the tokens are sorted
explode: true
in: query
name: sortBy
required: false
schema:
enum:
- profile.email
- profile.serial
- activated
- user.id
- created
- status
- lastVerified
type: string
style: form
- description: "Specifies the sort order, either `ASC` or `DESC`"
explode: true
in: query
name: sortOrder
required: false
schema:
enum:
- ASC
- DESC
type: string
style: form
responses:
"200":
content:
application/json:
examples:
ListYubikeyOptTokensResponse:
$ref: '#/components/examples/ListYubikeyOptTokensResponse'
schema:
items:
$ref: '#/components/schemas/UserFactorYubikeyOtpToken'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all YubiKey OTP Tokens
tags:
- UserFactor
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: Uploads a seed for a user to enroll a YubiKey OTP
operationId: uploadYubikeyOtpTokenSeed
parameters:
- description: Specifies the pagination cursor for the next page of tokens
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: "Embeds the [User](/openapi/okta-management/management/tag/User/)\
\ resource if the YubiKey Token is assigned to a user and `expand` is set\
\ to `user`"
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
- description: The expression used to filter tokens
explode: true
in: query
name: filter
required: false
schema:
enum:
- profile.email
- profile.serial
- activated
- user.id
- created
- status
- lastVerified
type: string
style: form
- description: "Returns tokens in a CSV to download instead of in the response.\
\ When you use this query parameter, the `limit` default changes to 1000."
explode: true
in: query
name: forDownload
required: false
schema:
default: false
type: boolean
style: form
- description: Specifies the number of results per page
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
type: integer
style: form
- description: The value of how the tokens are sorted
explode: true
in: query
name: sortBy
required: false
schema:
enum:
- profile.email
- profile.serial
- activated
- user.id
- created
- status
- lastVerified
type: string
style: form
- description: "Specifies the sort order, either `ASC` or `DESC`"
explode: true
in: query
name: sortOrder
required: false
schema:
enum:
- ASC
- DESC
type: string
style: form
requestBody:
content:
application/json:
examples:
uploadYubikeyOtpSeedRequest:
$ref: '#/components/examples/UploadYubikeyTokenSeedRequest'
schema:
$ref: '#/components/schemas/uploadYubikeyOtpTokenSeed_request'
required: true
responses:
"200":
content:
application/json:
examples:
yubikeyToken:
$ref: '#/components/examples/UploadYubikeyTokenSeedResponse'
schema:
$ref: '#/components/schemas/UserFactorYubikeyOtpToken'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Upload a YubiKey OTP Seed
tags:
- UserFactor
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/factors/yubikey_token/tokens/{tokenId}:
get:
description: Retrieves the specified YubiKey OTP Token by `id`
operationId: getYubikeyOtpTokenById
parameters:
- description: ID of a Yubikey token
explode: false
in: path
name: tokenId
required: true
schema:
example: ykkxdtCA1fKVxyu6R0g3
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Token:
$ref: '#/components/examples/GetYubikeyOptTokenResponse'
schema:
$ref: '#/components/schemas/UserFactorYubikeyOtpToken'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: Retrieve a YubiKey OTP Token
tags:
- UserFactor
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/logo:
post:
description: Uploads and replaces the logo for your organization
operationId: uploadOrgLogo
requestBody:
content:
multipart/form-data:
schema:
$ref: '#/components/schemas/uploadOrgLogo_request'
description: logo file
responses:
"201":
description: Created
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.apps.manage
summary: Upload the Org Logo
tags:
- OrgSettingCustomization
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: multipart/form-data
x-accepts:
- application/json
/api/v1/org/orgSettings/thirdPartyAdminSetting:
get:
description: "Retrieves the Third-Party Admin Setting. See [Configure third-party\
\ administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third)\
\ in the Okta product documentation."
operationId: getThirdPartyAdminSetting
parameters: []
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/ThirdPartyAdminSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Org Third-Party Admin Setting
tags:
- OrgSettingAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |
Updates the Third-Party Admin Setting.
This setting allows third-party admins to perform administrative actions in the Admin Console, but they can't do any of the following:
* Receive Okta admin email notifications
* Contact Okta support
* Sign in to the Okta Help Center
See [Configure third-party administrators](https://help.okta.com/okta_help.htm?type=oie&id=csh_admin-third) in the Okta product documentation.
operationId: updateThirdPartyAdminSetting
parameters: []
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ThirdPartyAdminSetting'
required: true
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/ThirdPartyAdminSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Update the Org Third-Party Admin Setting
tags:
- OrgSettingAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/preferences:
get:
description: Retrieves preferences of your Okta org
operationId: getOrgPreferences
parameters: []
responses:
"200":
content:
application/json:
examples:
retrieveOrgPrefEx:
$ref: '#/components/examples/orgShowFooterPrefResponse'
schema:
$ref: '#/components/schemas/OrgPreferences'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Org Preferences
tags:
- OrgSettingCustomization
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/preferences/hideEndUserFooter:
post:
description: Sets the preference to hide the Okta UI footer for all end users
of your org
operationId: setOrgHideOktaUIFooter
parameters: []
responses:
"200":
content:
application/json:
examples:
hideOrgPrefEx:
$ref: '#/components/examples/orgHideFooterPrefResponse'
schema:
$ref: '#/components/schemas/OrgPreferences'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Set the Hide Dashboard Footer Preference
tags:
- OrgSettingCustomization
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/preferences/showEndUserFooter:
post:
description: Sets the preference to show the Okta UI footer for all end users
of your org
operationId: setOrgShowOktaUIFooter
parameters: []
responses:
"200":
content:
application/json:
examples:
showOrgPrefEx:
$ref: '#/components/examples/orgShowFooterPrefResponse'
schema:
$ref: '#/components/schemas/OrgPreferences'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Set the Show Dashboard Footer Preference
tags:
- OrgSettingCustomization
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/aerial:
get:
description: Retrieves the Okta Aerial consent grant details for your Org. Returns
a 404 Not Found error if no consent has been granted.
operationId: getAerialConsent
parameters: []
responses:
"200":
content:
application/json:
examples:
example-read-grant-response:
$ref: '#/components/examples/AerialConsentDetails'
schema:
$ref: '#/components/schemas/OrgAerialConsentDetails'
description: Success
"400":
content:
application/json:
examples:
example-no-already-present-response:
$ref: '#/components/examples/AerialGrantAlreadyPresentErrorResponse'
schema:
$ref: '#/components/schemas/Error'
description: Can't complete request due to errors
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
example-no-grant-found-response:
$ref: '#/components/examples/AerialGrantNotFoundResponse'
schema:
$ref: '#/components/schemas/Error'
description: Consent hasn't been given and there are no grants to any Aerial
Accounts
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Retrieve Okta Aerial consent for your Org
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
x-accepts:
- application/json
/api/v1/org/privacy/aerial/grant:
post:
description: "Grants an Okta Aerial account access to your Org. If the org is\
\ a child org, consent is taken from the parent org. Grant calls directly\
\ to the child are not allowed."
operationId: grantAerialConsent
parameters: []
requestBody:
content:
application/json:
examples:
example-grant-call:
description: Request body to grant an Okta Aerial account access to
your Org
value:
accountId: 0200bs0617vvhv2v675mch1cukp
schema:
$ref: '#/components/schemas/OrgAerialConsent'
responses:
"200":
content:
application/json:
examples:
example-grant-success-response:
$ref: '#/components/examples/AerialConsentDetails'
schema:
$ref: '#/components/schemas/OrgAerialConsentDetails'
description: Success
"400":
content:
application/json:
examples:
example-invalid-account-id:
$ref: '#/components/examples/AerialConsentInvalidAccountIdResponse'
schema:
$ref: '#/components/schemas/Error'
description: Can't complete request due to errors
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Grant Okta Aerial access to your Org
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/privacy/aerial/revoke:
post:
description: Revokes access of an Okta Aerial account to your Org. The revoke
operation will fail if the org has already been added to an Aerial account.
operationId: revokeAerialConsent
parameters: []
requestBody:
content:
application/json:
examples:
example-revoke-request:
description: Request body for revoking an Okta Aerial account
value:
accountId: 0200bs0617vvhv2v675mch1cukp
schema:
$ref: '#/components/schemas/OrgAerialConsent'
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/OrgAerialConsentRevoked'
description: Success
"400":
content:
application/json:
examples:
example-org-is-linked:
$ref: '#/components/examples/AerialConsentOrgAlreadyLinkedResponse'
schema:
$ref: '#/components/schemas/Error'
description: Can't complete request due to errors
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Revoke Okta Aerial access to your Org
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
x-content-type: application/json
x-accepts:
- application/json
/api/v1/org/privacy/oktaCommunication:
get:
description: Retrieves Okta Communication Settings of your org
operationId: getOktaCommunicationSettings
parameters: []
responses:
"200":
content:
application/json:
examples:
retrieveOktaCommSettingsEx:
$ref: '#/components/examples/orgCommunicationOptOutResponse'
schema:
$ref: '#/components/schemas/OrgOktaCommunicationSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Okta Communication Settings
tags:
- OrgSettingCommunication
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/oktaCommunication/optIn:
post:
description: Opts in all users of this org to Okta communication emails
operationId: optInUsersToOktaCommunicationEmails
parameters: []
responses:
"200":
content:
application/json:
examples:
optInOktaCommSettingsEx:
$ref: '#/components/examples/orgCommunicationOptInResponse'
schema:
$ref: '#/components/schemas/OrgOktaCommunicationSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Opt in to Okta User Communication Emails
tags:
- OrgSettingCommunication
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/oktaCommunication/optOut:
post:
description: Opts out all users of this org from Okta communication emails
operationId: optOutUsersFromOktaCommunicationEmails
parameters: []
responses:
"200":
content:
application/json:
examples:
optOutOktaCommSettingsEx:
$ref: '#/components/examples/orgCommunicationOptOutResponse'
schema:
$ref: '#/components/schemas/OrgOktaCommunicationSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Opt out of Okta User Communication Emails
tags:
- OrgSettingCommunication
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/oktaSupport:
get:
description: Retrieves Okta Support Settings for your org
operationId: getOrgOktaSupportSettings
parameters: []
responses:
"200":
content:
application/json:
examples:
RetrieveOktaSupportEx:
$ref: '#/components/examples/orgSupportSettingsResponse'
schema:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Okta Support Settings
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/oktaSupport/extend:
post:
description: Extends the length of time that Okta Support can access your org
by 24 hours. This means that 24 hours are added to the remaining access time.
operationId: extendOktaSupport
parameters: []
responses:
"200":
content:
application/json:
examples:
ExtendOktaSupportEx:
$ref: '#/components/examples/orgSupportSettingsResponse'
schema:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Extend Okta Support Access
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/oktaSupport/grant:
post:
description: Grants Okta Support temporary access your org as an administrator
for eight hours
operationId: grantOktaSupport
parameters: []
responses:
"200":
content:
application/json:
examples:
GrantOktaSupportEx:
$ref: '#/components/examples/orgSupportSettingsResponse'
schema:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Grant Okta Support Access
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/privacy/oktaSupport/revoke:
post:
description: Revokes Okta Support access to your org
operationId: revokeOktaSupport
parameters: []
responses:
"200":
content:
application/json:
examples:
RevokeOktaSupportEx:
$ref: '#/components/examples/orgSupportSettingsRevokeResponse'
schema:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Revoke Okta Support Access
tags:
- OrgSettingSupport
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/org/settings/clientPrivilegesSetting:
get:
description: "Retrieves the org setting to assign the [Super Admin role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin)\
\ to new public client apps"
operationId: getClientPrivilegesSetting
parameters: []
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/ClientPrivilegesSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.read
summary: Retrieve the Default Public Client App Role Setting
tags:
- OrgSettingAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: "Assigns the [Super Admin role](https://help.okta.com/okta_help.htm?type=oie&id=ext_superadmin)\
\ as the default role for new public client apps"
operationId: assignClientPrivilegesSetting
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/ClientPrivilegesSetting'
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/ClientPrivilegesSetting'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Assign the Default Public Client App Role Setting
tags:
- OrgSettingAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/orgs:
post:
description: |-
Creates an Org (child org) that has the same features as the current requesting org (parent org).
A child org inherits any new features added to the parent org, but new features added to the child org aren't propagated back to the parent org.
> **Notes:**
> * Some features associated with products, such as Atspoke, Workflows, and Okta Identity Governance, aren't propagated to the child Org.
> * Wait at least 30 seconds after a 201-Created response before you make API requests to the new child Org.
> * For rate limits, see [Org creation rate limits](https://developer.okta.com/docs/reference/rl-additional-limits/#org-creation-rate-limits).
operationId: createChildOrg
requestBody:
content:
application/json:
examples:
CreateChildOrg:
$ref: '#/components/examples/CreateChildOrgRequestEx'
schema:
$ref: '#/components/schemas/ChildOrg'
responses:
"201":
content:
application/json:
examples:
CreateChildOrg:
$ref: '#/components/examples/CreateChildOrgResponseEx'
schema:
$ref: '#/components/schemas/ChildOrg'
description: Created
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"401":
content:
application/json:
examples:
InvalidTokenProvided:
$ref: '#/components/examples/ErrorInvalidTokenProvided'
schema:
$ref: '#/components/schemas/Error'
description: Unauthorized
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
"500":
content:
application/json:
examples:
InternalServerError:
$ref: '#/components/examples/ErrorInternalServer'
schema:
$ref: '#/components/schemas/Error'
description: Internal Server Error
security:
- apiToken: []
- oauth2:
- okta.orgs.manage
summary: Create an Org
tags:
- OrgCreator
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/policies:
get:
description: Lists all policies with the specified type
operationId: listPolicies
parameters:
- description: |-
Specifies the type of policy to return. The following policy types are available only with the Okta Identity Engine - `ACCESS_POLICY`, `PROFILE_ENROLLMENT`, `POST_AUTH_SESSION`, and `ENTITY_RISK`.
The `POST_AUTH_SESSION` and `ENTITY_RISK` policy types are in
\n\
> **Legal Disclaimer**\n> \n> After a User is added to the Okta directory,\
\ they receive an activation email. As part of signing up for this service,\n\
> you agreed not to use Okta's service/product to spam and/or send unsolicited\
\ messages.\n> Please refrain from adding unrelated accounts to the directory\
\ as Okta is not responsible for, and disclaims any and all\n> liability associated\
\ with, the activation email's content. You, and you alone, bear responsibility\
\ for the emails sent to any recipients.\n\nAll responses return the created\
\ User. Activation of a User is an asynchronous operation. The system performs\
\ group reconciliation during activation and assigns the User to all apps\
\ via direct or indirect relationships (group memberships).\n* The user's\
\ `transitioningToStatus` property is `ACTIVE` during activation to indicate\
\ that the User hasn't completed the asynchronous operation.\n* The user's\
\ `status` is `ACTIVE` when the activation process is complete.\n\nThe User\
\ is emailed a one-time activation token if activated without a password.\n\
\n> **Note:** If the User is assigned to an app that is configured for provisioning,\
\ the activation process triggers downstream provisioning to the app. It\
\ is possible for a User to sign in before these apps have been successfully\
\ provisioned for the User.\n\n> **Important:** Do not generate or send a\
\ one-time activation token when activating Users with an assigned password.\
\ Users should sign in with their assigned password.\n\nFor more information\
\ about the various scenarios of creating a user listed in the examples, see\
\ User Scenario Creations section in the [Users API](/openapi/okta-management/management/tag/User)\
\ description."
operationId: createUser
parameters:
- description: "Executes an [activation lifecycle](/openapi/okta-management/management/tag/UserLifecycle/#tag/UserLifecycle/operation/activateUser)\
\ operation when creating the User"
explode: true
in: query
name: activate
required: false
schema:
default: true
type: boolean
style: form
- description: Indicates whether to create a User with a specified authentication
provider
explode: true
in: query
name: provider
required: false
schema:
default: false
type: boolean
style: form
- description: "With `activate=true`, if `nextLogin=changePassword`, a User\
\ is created, activated, and the password is set to `EXPIRED`. The User\
\ must change it the next time they sign in."
explode: true
in: query
name: nextLogin
required: false
schema:
$ref: '#/components/schemas/UserNextLogin'
style: form
x-okta-added-version: 0.14.0
requestBody:
content:
application/json:
examples:
Create User without credentials:
$ref: '#/components/examples/create-user-without-credentials-request'
Create User with recovery question:
$ref: '#/components/examples/create-user-with-recovery-question-request'
Create User with Password:
$ref: '#/components/examples/create-user-with-password-request'
Create User with imported hashed password:
$ref: '#/components/examples/create-user-with-imported-hashed-password-request'
Create User with password import inline hook:
$ref: '#/components/examples/create-user-with-password-import-inline-hook-request'
Create User with Password and Recovery Question:
$ref: '#/components/examples/create-user-with-password-and-recovery-question-request'
Create User with Authentication Provider:
$ref: '#/components/examples/create-user-with-authentication-provider-request'
Create User in Group:
$ref: '#/components/examples/create-user-in-group-request'
Create User with non-default User Type:
$ref: '#/components/examples/create-user-with-non-default-user-type-request'
schema:
$ref: '#/components/schemas/CreateUserRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Create User without credentials:
$ref: '#/components/examples/create-user-without-credentials-response'
Create User with recovery question:
$ref: '#/components/examples/create-user-with-recovery-question-response'
Create User with Password:
$ref: '#/components/examples/create-user-with-password-response'
Create User with imported hashed password:
$ref: '#/components/examples/create-user-with-imported-hashed-password-response'
Create User with password import inline hook:
$ref: '#/components/examples/create-user-with-password-import-inline-hook-response'
Create User with Password and Recovery Question:
$ref: '#/components/examples/create-user-with-password-and-recovery-question-response'
Create User with Authentication Provider:
$ref: '#/components/examples/create-user-with-authentication-provider-response'
Create User in Group:
$ref: '#/components/examples/create-user-in-group-response'
Create User with non-default User Type:
$ref: '#/components/examples/create-user-with-non-default-user-type-response'
schema:
$ref: '#/components/schemas/User'
description: Success
"400":
content:
application/json:
examples:
Create User with too many groups specified:
$ref: '#/components/examples/ErrorCreateUserWithTooManyManyGroupsResponse'
Create User with expired password and activate set to `false`:
$ref: '#/components/examples/ErrorCreateUserWithExpiredPasswordWithoutActivation'
Create User with expired password and `null` password:
$ref: '#/components/examples/ErrorCreateUserWithExpiredPasswordWithNullPassword'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Create a User
tags:
- User
x-codegen-request-body-name: body
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/me/lifecycle/delete_sessions:
post:
description: |-
Ends Okta sessions for the currently signed in User. By default, the current session remains active. Use this method in a browser-based app.
> **Note:** This operation requires a session cookie for the User. The API token isn't allowed for this operation.
operationId: endUserSessions
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/KeepCurrent'
responses:
"200":
content: {}
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2: []
summary: End a current User session
tags:
- UserSessions
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/{id}:
delete:
description: "Deletes a User permanently. This operation can only be performed\
\ on Users that have a `DEPROVISIONED` status. **This action can't be recovered!**\n\
\nThis operation on a User that hasn't been deactivated causes that User to\
\ be deactivated. A second delete operation is required to delete the User.\n\
\n> **Note:** You can also perform user deletion asynchronously. To invoke\
\ asynchronous user deletion, pass an HTTP header `Prefer: respond-async`\
\ with the request. \nThis header is also supported by user deactivation,\
\ which is performed if the delete endpoint is invoked on a User that hasn't\
\ been deactivated."
operationId: deleteUser
parameters:
- description: "`id`, `login`, or `login shortname` (as long as it is unambiguous)\
\ of user"
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
- description: Sends a deactivation email to the admin if `true`
explode: true
in: query
name: sendEmail
required: false
schema:
default: false
type: boolean
style: form
x-okta-added-version: 1.5.0
- explode: false
in: header
name: Prefer
required: false
schema:
enum:
- respond-async
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Delete a User
tags:
- User
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: |-
Retrieves a User from your Okta org.
> **Note:** You can substitute `me` for the `id` to fetch the current User linked to an API token or session cookie.
> * The request returns the User linked to the API token that is specified in the Authorization header, not the User linked to the active session. Details of the Admin User who granted the API token is returned.
> * When the end User has an active Okta session, it is typically a CORS request from the browser. Therefore, it's possible to retrieve the current User without the Authorization header.
> **Note:** Some browsers block third-party cookies by default, which disrupts Okta functionality in certain flows. See [Mitigate the impact of third-party cookie deprecation](https://help.okta.com/okta_help.htm?type=oie&id=ext-third-party-cookies).
> **Note:** When fetching a User by `login` or `login shortname`, [URL encode](https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding) the request parameter to ensure that special characters are escaped properly. Logins with a `/` character can only be fetched by `id` due to URL issues with escaping the `/` character.
operationId: getUser
parameters:
- description: "`id`, `login`, or `login shortname` (as long as it is unambiguous)\
\ of user"
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
- description: |-
Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization.
Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck.
Enum values for `okta-response`:
* `omitCredentials`: Omits the credentials subobject from the response.
* `omitCredentialsLinks`: Omits the following HAL links from the response: Change Password, Change Recovery Question, Forgot Password, Reset Password, Reset Factors, Unlock.
* `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response.
examples:
Omit credentials subobject and credentials links:
summary: Omits the credentials subobject and credentials links from the
response. Does not apply performance optimization.
value: "application/json; okta-response=omitCredentials,omitCredentialsLinks"
Omit credentials, credentials links, and `transitioningToStatus` field:
summary: "Omits the credentials, credentials links, and `transitioningToStatus`\
\ field from the response. Applies performance optimization."
value: "application/json; okta-response=\"omitCredentials,omitCredentialsLinks,\
\ omitTransitioningToStatus\""
explode: false
in: header
name: Content-Type
required: false
schema:
type: string
style: simple
- description: "An optional parameter to include metadata in the `_embedded`\
\ attribute. Valid value: `blocks`"
explode: true
in: query
name: expand
required: false
schema:
example: blocks
type: string
style: form
responses:
"200":
content:
application/json:
examples:
GetUserExample:
$ref: '#/components/examples/user-example'
schema:
$ref: '#/components/schemas/UserGetSingleton'
description: Success
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: Retrieve a User
tags:
- User
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Updates a user's profile or credentials with partial update semantics.
> **Important:** Use the `POST` method for partial updates. Unspecified properties are set to null with `PUT`.
`profile` and `credentials` can be updated independently or together with a single request.
> **Note**: Currently, the User Type of a User can only be changed via a full replacement PUT operation. If the request parameters of a partial update include the type element from the User object,
the value must match the existing type of the User. Only admins are permitted to change the User type of a User; end users are not allowed to change their own User type.
> **Note**: To update a current user's profile with partial semantics, the `/api/v1/users/me` endpoint can be invoked.
>
> A User can only update profile properties for which the User has write access. Within the profile, if the User tries to update the primary or the secondary email IDs, verification emails are sent to those email IDs, and the fields are updated only upon verification.
If you are using this endpoint to set a password, it sets a password without validating existing user credentials. This is an administrative operation. For operations that validate credentials, refer to the `Reset Password`, `Forgot Password`, and `Change Password` endpoints.
operationId: updateUser
parameters:
- description: "`id`, `login`, or `login shortname` (as long as it is unambiguous)\
\ of user"
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
- description: "If true, validates against minimum age and history password\
\ policy"
explode: true
in: query
name: strict
required: false
schema:
type: boolean
style: form
requestBody:
content:
application/json:
examples:
Update User Profile:
$ref: '#/components/examples/update-user-profile-request'
Update User Password:
$ref: '#/components/examples/update-user-set-password-request'
Set Recovery Question and Answer:
$ref: '#/components/examples/update-user-set-recovery-question-and-answer'
schema:
$ref: '#/components/schemas/UpdateUserRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Update User Response:
$ref: '#/components/examples/user-example'
schema:
$ref: '#/components/schemas/User'
description: Success
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Update a User
tags:
- User
x-codegen-request-body-name: user
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
put:
description: |-
Replaces a User's profile, credentials, or both using strict-update semantics.
All profile properties must be specified when updating a User's profile with a `PUT` method. Any property not specified in the request is deleted.
> **Important:** Don't use a `PUT` method for partial updates.
operationId: replaceUser
parameters:
- description: "`id`, `login`, or `login shortname` (as long as it is unambiguous)\
\ of user"
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
- description: "If `true`, validates against minimum age and history password\
\ policy"
explode: true
in: query
name: strict
required: false
schema:
type: boolean
style: form
x-okta-added-version: 1.10.0
requestBody:
content:
application/json:
examples:
Replace User Request:
$ref: '#/components/examples/replace-user-request'
schema:
$ref: '#/components/schemas/UpdateUserRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Replace User Response:
$ref: '#/components/examples/user-example'
schema:
$ref: '#/components/schemas/User'
description: Success
"400":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Replace a User
tags:
- User
x-codegen-request-body-name: user
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/{id}/lifecycle/reactivate:
post:
description: |-
Reactivates a user.
This operation can only be performed on Users with a `PROVISIONED` or `RECOVERY` [status](/openapi/okta-management/management/tag/User/#tag/User/operation/listUsers!c=200&path=status&t=response).
This operation restarts the activation workflow if for some reason the user activation wasn't completed when using the `activationToken` from [Activate User](/openapi/okta-management/management/tag/UserLifecycle/#tag/UserLifecycle/operation/activateUser).
Users that don't have a password must complete the flow by completing [Reset Password](/openapi/okta-management/management/tag/UserCred/#tag/UserCred/operation/resetPassword) and MFA enrollment steps to transition the user to `ACTIVE` status.
If `sendEmail` is `false`, returns an activation link for the user to set up their account. The activation token can be used to create a custom activation link.
operationId: reactivateUser
parameters:
- description: "`id`, `login`, or `login shortname` (as long as it is unambiguous)\
\ of user"
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
- description: Sends an activation email to the user if `true`
explode: true
in: query
name: sendEmail
required: false
schema:
default: false
type: boolean
style: form
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/UserActivationToken'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Reactivate a User
tags:
- UserLifecycle
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userIdOrLogin}/linkedObjects/{primaryRelationshipName}/{primaryUserId}:
put:
description: |-
Assigns the first User as the `associated` and the second User as the `primary` for the specified relationship.
If the first User is already associated with a different `primary` for this relationship, the previous link is removed. A Linked Object relationship can specify only one primary User for an associated User.
operationId: assignLinkedObjectValueForPrimary
parameters:
- description: |-
If for the `self` link, the ID of the User for whom you want to get the primary User ID. If for the `associated` relation, the User ID or login value of the User assigned the associated relationship.
This can be `me` to represent the current session User.
examples:
manager:
summary: Example ID of `primary`
value: 00u5zex6ztMbOZhF50h7
subordinate:
summary: Example ID of `associated`
value: 00u5zex6ztMbOZhF50h7
explode: false
in: path
name: userIdOrLogin
required: true
schema:
type: string
style: simple
- description: Name of the `primary` relationship being assigned
explode: false
in: path
name: primaryRelationshipName
required: true
schema:
example: manager
type: string
style: simple
- description: User ID to be assigned to the `primary` relationship for the
`associated` user
explode: false
in: path
name: primaryUserId
required: true
schema:
type: string
style: simple
responses:
"204":
content: {}
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- oauth2:
- okta.users.manage
summary: Assign a Linked Object value for primary
tags:
- UserLinkedObject
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userIdOrLogin}/linkedObjects/{relationshipName}:
delete:
description: |-
Deletes any existing relationship between the `associated` and `primary` user. For the `associated` User, this is specified by the ID. The `primary` name specifies the relationship.
The operation is successful if the relationship is deleted or if the specified User isn't in the `associated` relationship for any instance of the specified `primary` and thus, no relationship is found.
operationId: deleteLinkedObjectForUser
parameters:
- description: |-
If for the `self` link, the ID of the User for whom you want to get the primary User ID. If for the `associated` relation, the User ID or login value of the User assigned the associated relationship.
This can be `me` to represent the current session User.
examples:
manager:
summary: Example ID of `primary`
value: 00u5zex6ztMbOZhF50h7
subordinate:
summary: Example ID of `associated`
value: 00u5zex6ztMbOZhF50h7
explode: false
in: path
name: userIdOrLogin
required: true
schema:
type: string
style: simple
- description: Name of the `primary` or `associated` relationship being queried
examples:
manager:
summary: Example of a `primary` name
value: manager
subordinate:
summary: Example of an `associated` name
value: subordinate
explode: false
in: path
name: relationshipName
required: true
schema:
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Delete a Linked Object value
tags:
- UserLinkedObject
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: |-
Lists either the `self` link for the primary User or all associated Users in the relationship specified by `relationshipName`. If the specified User isn't associated in any relationship, an empty array is returned.
Use `me` instead of `id` to specify the current session User.
operationId: listLinkedObjectsForUser
parameters:
- description: |-
If for the `self` link, the ID of the User for whom you want to get the primary User ID. If for the `associated` relation, the User ID or login value of the User assigned the associated relationship.
This can be `me` to represent the current session User.
examples:
manager:
summary: Example ID of `primary`
value: 00u5zex6ztMbOZhF50h7
subordinate:
summary: Example ID of `associated`
value: 00u5zex6ztMbOZhF50h7
explode: false
in: path
name: userIdOrLogin
required: true
schema:
type: string
style: simple
- description: Name of the `primary` or `associated` relationship being queried
examples:
manager:
summary: Example of a `primary` name
value: manager
subordinate:
summary: Example of an `associated` name
value: subordinate
explode: false
in: path
name: relationshipName
required: true
schema:
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
GetPrimaryLinkedObjectResponse:
$ref: '#/components/examples/GetPrimaryLinkedObjectResponse'
GetAssociatedLinkedObjectResponse:
$ref: '#/components/examples/GetAssociatedLinkedObjectsResponse'
schema:
items:
$ref: '#/components/schemas/ResponseLinks'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List the primary or all of the associated Linked Object values
tags:
- UserLinkedObject
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/appLinks:
get:
description: Lists all App Links for all direct or indirect (via group membership)
assigned apps
operationId: listAppLinks
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
List App Links:
$ref: '#/components/examples/ListAppLinks'
schema:
items:
$ref: '#/components/schemas/AppLink'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all Assigned App Links
tags:
- UserResources
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/blocks:
get:
description: Lists information about how the User is blocked from accessing
their account
operationId: listUserBlocks
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
BlocksUnknownDevices:
$ref: '#/components/examples/ListUserBlocksUnknownDevicesResponse'
BlocksAnyDevices:
$ref: '#/components/examples/ListUserBlocksAnyDevicesResponse'
schema:
items:
$ref: '#/components/schemas/UserBlock'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all User Blocks
tags:
- User
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/clients:
get:
description: Lists all Client resources for which the specified User has grants
or tokens
operationId: listUserClients
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
List User Clients:
$ref: '#/components/examples/ListUserClients'
schema:
items:
$ref: '#/components/schemas/OAuth2Client'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all Clients
tags:
- UserResources
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/clients/{clientId}/grants:
delete:
description: Revokes all Grants for the specified User and client
operationId: revokeGrantsForUserAndClient
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Revoke all Grants for a Client
tags:
- UserGrant
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Lists all Grants for a specified User and client
operationId: listGrantsForUserAndClient
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
- description: "Valid value: `scope`. If specified, scope details are included\
\ in the `_embedded` attribute."
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of tokens to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
maximum: 200
minimum: 1
type: integer
style: form
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/OAuth2ScopeConsentGrant'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all Grants for a Client
tags:
- UserGrant
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/clients/{clientId}/tokens:
delete:
description: Revokes all refresh Tokens issued for the specified User and client
operationId: revokeTokensForUserAndClient
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Revoke all Refresh Tokens for a Client
tags:
- UserOAuth
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Lists all refresh Tokens issued for the specified User and client
operationId: listRefreshTokensForUserAndClient
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
- description: "Valid value: `scope`. If specified, scope details are included\
\ in the `_embedded` attribute."
explode: true
in: query
name: expand
required: false
schema:
example: scope
type: string
style: form
- description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- description: Specifies the number of tokens to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
maximum: 200
minimum: 1
type: integer
style: form
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/OAuth2RefreshToken'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all Refresh Tokens for a Client
tags:
- UserOAuth
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId}:
delete:
description: Revokes the specified refresh Token
operationId: revokeTokenForUserAndClient
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
- description: '`id` of Token'
explode: false
in: path
name: tokenId
required: true
schema:
example: sHHSth53yJAyNSTQKDJZ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Revoke a Token for a Client
tags:
- UserOAuth
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a refresh Token issued for the specified User and client
operationId: getRefreshTokenForUserAndClient
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
- description: '`id` of Token'
explode: false
in: path
name: tokenId
required: true
schema:
example: sHHSth53yJAyNSTQKDJZ
type: string
style: simple
- description: "Valid value: `scope`. If specified, scope details are included\
\ in the `_embedded` attribute."
explode: true
in: query
name: expand
required: false
schema:
example: scope
type: string
style: form
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/OAuth2RefreshToken'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: Retrieve a Refresh Token for a Client
tags:
- UserOAuth
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/credentials/change_password:
post:
description: |-
Updates a User's password by validating the User's current Password.
This operation provides an option to delete all the sessions of the specified User. However, if the request is made in the context of a session owned by the specified User, that session isn't cleared.
You can only perform this operation on Users in `STAGED`, `ACTIVE`, `PASSWORD_EXPIRED`, or `RECOVERY` status that have a valid [Password credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request).
The User transitions to `ACTIVE` status when successfully invoked in `RECOVERY` status.
operationId: changePassword
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: "If true, validates against password minimum age policy"
explode: true
in: query
name: strict
required: false
schema:
default: false
type: boolean
style: form
x-okta-added-version: 1.10.0
requestBody:
content:
application/json:
examples:
Change Password Request:
$ref: '#/components/examples/ChangePwdRequest'
schema:
$ref: '#/components/schemas/ChangePasswordRequest'
required: true
responses:
"200":
content:
application/json:
examples:
Change Password Response:
$ref: '#/components/examples/ChangePwdResponse'
schema:
$ref: '#/components/schemas/UserCredentials'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Update Password
tags:
- UserCred
x-codegen-request-body-name: changePasswordRequest
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/{userId}/credentials/change_recovery_question:
post:
description: |-
Updates a User's Recovery Question and answer credential by validating the User's current Password.
You can only perform this operation on Users in `STAGED`, `ACTIVE`, or `RECOVERY` status that have a valid [Password credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/password&t=request).
operationId: changeRecoveryQuestion
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
requestBody:
content:
application/json:
examples:
Update Recovery Question Request:
$ref: '#/components/examples/UpdateRecQuestionRequest'
schema:
$ref: '#/components/schemas/UserCredentials'
required: true
responses:
"200":
content:
application/json:
examples:
Update Recovery Question Response:
$ref: '#/components/examples/UpdateRecQuestionResponse'
schema:
$ref: '#/components/schemas/UserCredentials'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Update Recovery Question
tags:
- UserCred
x-codegen-request-body-name: userCredentials
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/{userId}/credentials/forgot_password:
post:
description: |-
Starts the forgot password flow.
Generates a one-time token (OTT) that you can use to reset a User's Password.
The User must validate their security question's answer when visiting the reset link. This operation can only be performed on Users with an ACTIVE status and
a valid [Recovery Question credential](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/createUser!path=credentials/recovery_question&t=request).
> **Note:** If you have migrated to Identity Engine, you can allow Users to recover passwords with any enrolled MFA authenticator. See [Self-service account recovery](https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/configure-sspr.htm?cshid=ext-config-sspr)
If an email address is associated with multiple Users, keep in mind the following to ensure a successful password recovery lookup:
* Okta no longer includes deactivated Users in the lookup.
* The lookup searches sign-in IDs first, then primary email addresses, and then secondary email addresses.
If `sendEmail` is `false`, returns a link for the User to reset their Password. This operation doesn't affect the status of the User.
operationId: forgotPassword
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: Sends a forgot password email to the User if `true`
explode: true
in: query
name: sendEmail
required: false
schema:
default: true
type: boolean
style: form
responses:
"200":
content:
application/json:
examples:
Forgot Password Response:
$ref: '#/components/examples/ForgotPwdResponse'
schema:
$ref: '#/components/schemas/ForgotPasswordResponse'
description: Reset URL
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Start forgot password flow
tags:
- UserCred
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/credentials/forgot_password_recovery_question:
post:
description: |-
Resets the User's password to the specified password if the provided answer to the recovery question is correct.
You must include the Recovery Question answer with the submission.
operationId: forgotPasswordSetNewPassword
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- explode: true
in: query
name: sendEmail
required: false
schema:
default: true
type: boolean
style: form
requestBody:
content:
application/json:
examples:
Forgot Password Recovery Question Request:
$ref: '#/components/examples/ForgotPwdRecoveryQuestionRequest'
schema:
$ref: '#/components/schemas/UserCredentials'
required: true
responses:
"200":
content:
application/json:
examples:
Forgot Password Recovery Question Response:
$ref: '#/components/examples/ForgotPwdRecoveryQuestionResponse'
schema:
$ref: '#/components/schemas/UserCredentials'
description: Credentials
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Reset Password with Recovery Question
tags:
- UserCred
x-codegen-request-body-name: userCredentials
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/{userId}/factors:
get:
description: Lists all enrolled Factors for the specified user
operationId: listFactors
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
ListFactorsResponse:
$ref: '#/components/examples/ListFactorsResults'
schema:
items:
$ref: '#/components/schemas/UserFactor'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all enrolled Factors
tags:
- UserFactor
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Enrolls a supported Factor for the specified user
> **Note:** All responses return the enrolled Factor with a status of either `PENDING_ACTIVATION`` or `ACTIVE`.
#### Additional SMS/Call Factor information
* **Rate limits**: Okta may return a `429 Too Many Requests` status code if you attempt to resend an SMS or a voice call challenge (OTP) within the same time window. The current [rate limit](https://developer.okta.com/docs/reference/rate-limits/) is one SMS/CALL challenge per phone number every 30 seconds.
* **Existing phone numbers**: Okta may return a `400 Bad Request` status code if a user attempts to enroll with a different phone number when the user has an existing mobile phone or has an existing phone with voice call capability. A user can enroll only one mobile phone for `sms` and enroll only one voice call capable phone for `call` factor.
#### Additional WebAuthn Factor information
**Enroll WebAuthn response parameters**
* For detailed information on the Webauthn standard, including an up-to-date list of supported browsers, see [webauthn.me](https://a0.to/webauthnme-okta-docs).
* In the enroll API response, the `response._embedded.activation` object contains properties used to help the client to create a new WebAuthn credential for use with Okta. See the [WebAuthn spec for PublicKeyCredentialCreationOptions](https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions).
#### Additional Custom TOTP Factor information
**Enroll Custom TOTP Factor**
* The enrollment process involves passing both the `factorProfileId` and `sharedSecret` properties for a token.
* A Factor Profile represents a particular configuration of the Custom TOTP factor. It includes certain properties that match the hardware token that end users possess, such as the HMAC algorithm, passcode length, and time interval. There can be multiple Custom TOTP factor profiles per org, but users can only enroll in one Custom TOTP factor. Admins can [create Custom TOTP factor profiles](https://help.okta.com/okta_help.htm?id=ext-mfa-totp) in the Admin Console. Then, copy the `factorProfileId` from the Admin Console into the API request.
*
If you have integrated Okta with your on-premises Active Directory (AD), then setting a User's Password as expired in Okta also expires the Password in AD.
When the User tries to sign in to Okta, delegated authentication finds the password-expired status in AD,
and the User is presented with the password-expired page where they can change their Password.
operationId: expirePassword
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Expire Password Response:
$ref: '#/components/examples/ExpirePwdResponse'
schema:
$ref: '#/components/schemas/User'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Expire Password
tags:
- UserCred
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/lifecycle/expire_password_with_temp_password:
post:
description: |-
Expires the password and resets the User's Password to a temporary password. This operation transitions the User status to `PASSWORD_EXPIRED` so that the User must change their password the next time that they sign in.
User's Password is reset to a temporary password that is returned, and then the User's Password is expired.
If `revokeSessions` is included in the request with a value of `true`, the User's current outstanding sessions are revoked and require re-authentication.
If you have integrated Okta with your on-premises Active Directory (AD), then setting a User's Password as expired in Okta also expires the Password in AD.
When the User tries to sign in to Okta, delegated authentication finds the password-expired status in AD,
and the User is presented with the password-expired page where they can change their Password.
operationId: expirePasswordWithTempPassword
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: Revokes the User's existing sessions if `true`
explode: true
in: query
name: revokeSessions
required: false
schema:
default: false
type: boolean
style: form
responses:
"200":
content:
application/json:
examples:
Expire Password with Temp Password Response:
$ref: '#/components/examples/ExpirePwdWithTempPwdResponse'
schema:
$ref: '#/components/schemas/User'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Expire Password with temporary password
tags:
- UserCred
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/lifecycle/reset_factors:
post:
description: Resets all factors for the specified User. All MFA factor enrollments
return to the unenrolled state. The User's status remains `ACTIVE`. This link
is present only if the User is currently enrolled in one or more MFA factors.
operationId: resetFactors
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content: {}
description: OK
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Reset Factors
tags:
- UserLifecycle
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/lifecycle/reset_password:
post:
description: |-
Resets password. Generates a one-time token (OTT) that you can use to reset a User's password. You can automatically email the OTT link to the User or return the OTT to the API caller and distribute using a custom flow.
This operation transitions the User to the `RECOVERY` status. The User is then not able to sign in or initiate a forgot password flow until they complete the reset flow.
This operation provides an option to delete all the User's sessions. However, if the request is made in the context of a session owned by the specified User, that session isn't cleared.
> **Note:** You can also use this API to convert a User with the Okta Credential Provider to use a Federated Provider. After this conversion, the User can't directly sign in with a password.
> To convert a federated User back to an Okta User, use the default API call.
If an email address is associated with multiple Users, keep in mind the following to ensure a successful password recovery lookup:
* Okta no longer includes deactivated Users in the lookup.
* The lookup searches sign-in IDs first, then primary email addresses, and then secondary email addresses.
If `sendEmail` is `false`, returns a link for the User to reset their password.
operationId: resetPassword
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- explode: true
in: query
name: sendEmail
required: true
schema:
type: boolean
style: form
- description: "Revokes all User sessions, except for the current session, if\
\ set to `true`"
explode: true
in: query
name: revokeSessions
required: false
schema:
default: false
type: boolean
style: form
responses:
"200":
content:
application/json:
examples:
Reset Password without Sending Email Response:
$ref: '#/components/examples/ResetPwdWithoutSendingEmailResponse'
schema:
$ref: '#/components/schemas/ResetPasswordToken'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Reset password
tags:
- UserCred
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/lifecycle/suspend:
post:
description: |-
Suspends a user. This operation can only be performed on Users with an `ACTIVE` status. The User has a `SUSPENDED` status when the process completes.
Suspended users can't sign in to Okta. They can only be unsuspended or deactivated. Their group and app assignments are retained.
operationId: suspendUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content: {}
description: OK
"400":
content:
application/json:
examples:
MissingRequiredParameter:
$ref: '#/components/examples/ErrorMissingRequiredParameter'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Suspend a User
tags:
- UserLifecycle
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/lifecycle/unlock:
post:
description: |-
Unlocks a User with a `LOCKED_OUT` status or unlocks a User with an `ACTIVE` status that is blocked from unknown devices. Unlocked Users have an `ACTIVE` status and can sign in with their current password.
> **Note:** This operation works with Okta-sourced users. It doesn't support directory-sourced accounts such as Active Directory.
operationId: unlockUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content: {}
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Unlock a User
tags:
- UserLifecycle
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/lifecycle/unsuspend:
post:
description: Unsuspends a user and returns them to the `ACTIVE` state. This
operation can only be performed on users that have a `SUSPENDED` status.
operationId: unsuspendUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content: {}
description: Success
"400":
content:
application/json:
examples:
MissingRequiredParameter:
$ref: '#/components/examples/ErrorMissingRequiredParameter'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Unsuspend a User
tags:
- UserLifecycle
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/roles:
get:
description: Lists all roles assigned to a User (identified by `userId`)
operationId: listAssignedRolesForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: "An optional parameter used to return targets configured for\
\ the standard Role Assignment in the `embedded` property. Supported values:\
\ `targets/groups` or `targets/catalog/apps`"
examples:
groupTarget:
summary: Return Group targets
value: targets/groups
appTarget:
summary: Return App targets
value: targets/catalog/apps
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
responses:
"200":
content:
application/json:
examples:
Standard Roles:
$ref: '#/components/examples/StandardRolesListResponse'
Custom Roles:
$ref: '#/components/examples/StandardAndCustomRolesListResponse'
IAM-based Standard Roles:
$ref: '#/components/examples/IAMStandardRolesListResponse'
schema:
items:
$ref: '#/components/schemas/listGroupAssignedRoles_200_response_inner'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all User Role Assignments
tags:
- RoleAssignmentAUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Assigns a [standard role](/openapi/okta-management/guides/roles/#standard-roles) to a User.
You can also assign a custom role to a User, but the preferred method to assign a custom role to a User is to create a binding between the Custom Role, the Resource Set, and the User. See [Create a Role Resource Set Binding](/openapi/okta-management/management/tag/RoleDResourceSetBinding/#tag/RoleDResourceSetBinding/operation/createResourceSetBinding).
> **Notes:**
> * The request payload is different for standard and custom role assignments.
> * For IAM-based standard role assignments, use the request payload for standard roles. However, the response payload for IAM-based role assignments is similar to the custom role's assignment response.
operationId: assignRoleToUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: Setting this to `true` grants the User third-party admin status
explode: true
in: query
name: disableNotifications
required: false
schema:
default: false
type: boolean
style: form
requestBody:
content:
application/json:
schema:
$ref: '#/components/schemas/assignRoleToUser_request'
required: true
responses:
"201":
content:
application/json:
examples:
Standard Roles:
$ref: '#/components/examples/StandardRoleResponseUser'
Custom Roles:
$ref: '#/components/examples/CustomRoleResponseUser'
IAM-based Standard Roles:
$ref: '#/components/examples/IAMStandardRoleResponseUser'
schema:
$ref: '#/components/schemas/assignRoleToUser_201_response'
description: Created
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign a User Role
tags:
- RoleAssignmentAUser
x-codegen-request-body-name: assignRoleRequest
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/users/{userId}/roles/{roleAssignmentId}:
delete:
description: Unassigns a Role Assignment (identified by `roleAssignmentId`)
from a User (identified by `userId`)
operationId: unassignRoleFromUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign a User Role
tags:
- RoleAssignmentAUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
get:
description: Retrieves a Role assigned to a User (identified by `userId`). The
`roleAssignmentId` parameter is the unique identifier for either a standard
Role Assignment object or a custom role Resource Set Binding object.
operationId: getUserAssignedRole
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
responses:
"200":
content:
application/json:
examples:
Standard Roles:
$ref: '#/components/examples/StandardRoleResponseUser'
Custom Roles:
$ref: '#/components/examples/CustomRoleResponseUser'
IAM-based Standard Roles:
$ref: '#/components/examples/IAMStandardRoleResponseUser'
schema:
$ref: '#/components/schemas/listGroupAssignedRoles_200_response_inner'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: Retrieve a User Role Assignment
tags:
- RoleAssignmentAUser
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/roles/{roleAssignmentId}/governance: {}
/api/v1/users/{userId}/roles/{roleAssignmentId}/governance/{grantId}: {}
/api/v1/users/{userId}/roles/{roleAssignmentId}/governance/{grantId}/resources: {}
/api/v1/users/{userId}/roles/{roleAssignmentId}/targets/catalog/apps:
get:
description: "Lists all app targets for an `APP_ADMIN` Role Assigned to a User.\
\ The response is a list that includes OIN-cataloged apps or app instances.\
\ The response payload for an app instance contains the `id` property, but\
\ an OIN-cataloged app payload doesn't."
operationId: listApplicationTargetsForApplicationAdministratorRoleForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/CatalogApplication'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Admin Role Application Targets
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: Assigns all Apps as Target to Role
operationId: assignAllAppsAsTargetToRoleForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
responses:
"200":
content: {}
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign all Apps as Target to Role
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}:
delete:
description: |
Unassigns an OIN app target from an `APP_ADMIN` Role Assignment to an admin User.
> **Note:** You can't remove the last OIN app target from a Role Assignment since this causes an exception.
> If you need a Role Assignment that applies to all apps, delete the `APP_ADMIN` Role Assignment to the User and recreate a new one.
operationId: unassignAppTargetFromAppAdminRoleForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign an Admin Role Application Target
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |
Assigns an OIN app target for an `APP_ADMIN` Role Assignment to an admin User. When you assign the first app target, you reduce the scope of the Role Assignment.
The Role no longer applies to all app targets, but applies only to the specified target. Assigning an OIN app target overrides any existing app instance targets of the OIN app.
For example, if a user was assigned to administer a specific Facebook instance, a successful request to add an OIN app target with `facebook` for `appName` makes that user the administrator for all Facebook instances.
operationId: assignAppTargetToAdminRoleForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign an Admin Role Application Target
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/roles/{roleAssignmentId}/targets/catalog/apps/{appName}/{appId}:
delete:
description: |-
Unassigns an app instance target from an `APP_ADMIN` Role Assignment to an admin User.
> **Note:** You can't remove the last app instance target from a Role Assignment since this causes an exception.
> If you need a Role Assignment that applies to all apps, delete the `APP_ADMIN` Role Assignment and recreate a new one.
operationId: unassignAppInstanceTargetFromAdminRoleForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign an Admin Role Application Instance Target
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: "Assigns an app instance target to an `APP_ADMIN` Role Assignment\
\ to an admin User. When you assign the first OIN app or app instance target,\
\ you reduce the scope of the Role Assignment.\nThe Role no longer applies\
\ to all app targets, but applies only to the specified target.\n \
\ \n> **Note:** You can target a mixture of both OIN app and app instance\
\ targets, but can't assign permissions to manage all instances of an OIN\
\ app and then assign a subset of permission to the same OIN app.\n> For example,\
\ you can't specify that an admin has access to manage all instances of the\
\ Salesforce app and then also manage specific configurations of the Salesforce\
\ app.\n"
operationId: assignAppInstanceTargetToAppAdminRoleForUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
- description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign an Admin Role Application Instance Target
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/roles/{roleAssignmentId}/targets/groups:
get:
description: |
Lists all Group targets for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` Role Assignment to an admin User.
If the Role isn't scoped to specific Group targets, an empty array `[]` is returned.
operationId: listGroupTargetsForRole
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- explode: true
in: query
name: after
required: false
schema:
type: string
style: form
- explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
type: integer
style: form
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/Group'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.read
summary: List all Admin Role Group Targets
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/roles/{roleAssignmentId}/targets/groups/{groupId}:
delete:
description: |
Unassigns a Group target from a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` Role Assignment to an admin User.
> **Note:** You can't remove the last Group target from a Role Assignment since this causes an exception.
> If you need a Role Assignment that applies to all Groups, delete the Role Assignment to the User and recreate a new one.
operationId: unassignGroupTargetFromUserAdminRole
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Unassign an Admin Role Group Target
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
put:
description: |
Assigns a Group target for a `USER_ADMIN`, `HELP_DESK_ADMIN`, or `GROUP_MEMBERSHIP_ADMIN` Role Assignment to an admin User.
When you assign the first Group target, you reduce the scope of the Role Assignment. The Role no longer applies to all targets but applies only to the specified target.
operationId: assignGroupTargetToUserRole
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
- description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.roles.manage
summary: Assign an Admin Role Group Target
tags:
- RoleBTargetAdmin
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/sessions:
delete:
description: |-
Revokes all active Identity Provider sessions of the User. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the User.
> **Note:** This operation doesn't clear the sessions created for web or native apps.
operationId: revokeUserSessions
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
- description: Revoke issued OpenID Connect and OAuth refresh and access tokens
explode: true
in: query
name: oauthTokens
required: false
schema:
default: false
type: boolean
style: form
responses:
"204":
content: {}
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Revoke all User sessions
tags:
- UserSessions
x-okta-lifecycle:
isCorsEnabled: true
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/subscriptions:
get:
description: Lists all subscriptions available to a specified User. Returns
an `AccessDeniedException` message if requests are made for another user.
operationId: listSubscriptionsUser
parameters:
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
items:
$ref: '#/components/schemas/Subscription'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: List all Subscriptions for a User
tags:
- Subscription
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/subscriptions/{notificationType}:
get:
description: Retrieves a subscription by `notificationType` for a specified
User. Returns an `AccessDeniedException` message if requests are made for
another user.
operationId: getSubscriptionsNotificationTypeUser
parameters:
- explode: false
in: path
name: notificationType
required: true
schema:
$ref: '#/components/schemas/NotificationType'
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
content:
application/json:
schema:
$ref: '#/components/schemas/Subscription'
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.read
summary: Retrieve a Subscription for a User
tags:
- Subscription
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/subscriptions/{notificationType}/subscribe:
post:
description: Subscribes the current User to a specified notification type. Returns
an `AccessDeniedException` message if requests are made for another user.
operationId: subscribeByNotificationTypeUser
parameters:
- explode: false
in: path
name: notificationType
required: true
schema:
$ref: '#/components/schemas/NotificationType'
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Subscribe a User to a Specific Notification Type
tags:
- Subscription
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/users/{userId}/subscriptions/{notificationType}/unsubscribe:
post:
description: Unsubscribes the current User from a specified notification type.
Returns an `AccessDeniedException` message if requests are made for another
user.
operationId: unsubscribeByNotificationTypeUser
parameters:
- explode: false
in: path
name: notificationType
required: true
schema:
$ref: '#/components/schemas/NotificationType'
style: simple
- description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
responses:
"200":
description: No Content
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"404":
description: Not Found
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.users.manage
summary: Unsubscribe a User from a Specific Notification Type
tags:
- Subscription
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
/api/v1/zones:
get:
description: |-
Lists all Network Zones with pagination. A subset of zones can be returned that match a supported filter expression or query.
This operation requires URL encoding. For example, `filter=(id eq "nzoul0wf9jyb8xwZm0g3" or id eq "nzoul1MxmGN18NDQT0g3")` is encoded as `filter=%28id+eq+%22nzoul0wf9jyb8xwZm0g3%22+or+id+eq+%22nzoul1MxmGN18NDQT0g3%22%29`.
Okta supports filtering on the `id` and `usage` properties. See [Filtering](https://developer.okta.com/docs/reference/core-okta-api/#filter) for more information on the expressions that are used in filtering.
operationId: listNetworkZones
parameters:
- explode: true
in: query
name: after
required: false
schema:
description: Specifies the pagination cursor for the next page of Network
Zones
example: BlockedIpZones
type: string
style: form
- explode: true
in: query
name: limit
required: false
schema:
default: -1
description: Specifies the number of results for a page
example: 5
format: int32
type: integer
style: form
- explode: true
in: query
name: filter
required: false
schema:
description: Filters zones by usage or ID expression
example: id eq "nzowc1U5Jh5xuAK0o0g3"
type: string
style: form
responses:
"200":
content:
application/json:
examples:
RetrieveAllZonesWithFilter:
$ref: '#/components/examples/RetrieveAllZonesWithFilter'
RetrieveAllZones:
$ref: '#/components/examples/RetrieveAllZones'
schema:
items:
$ref: '#/components/schemas/NetworkZone'
type: array
description: Success
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.networkZones.read
summary: List all Network Zones
tags:
- NetworkZone
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-accepts:
- application/json
post:
description: |-
Creates a Network Zone
* For an IP Network Zone, you must define either `gateways` or `proxies`.
* For a Dynamic Network Zone, you must define at least one of the following: `asns`, `locations`, or `proxyType`.
* For an Enhanced Dynamic Network Zone, you must define at least one of the following: `asns`, `locations`, or `ipServiceCategories`.
operationId: createNetworkZone
requestBody:
content:
application/json:
examples:
CreateIPPolicyNetworkZone:
$ref: '#/components/examples/CreateIPPolicyNetworkZone'
CreateIPPolicyBlocklistNetworkZone:
$ref: '#/components/examples/CreateIPPolicyBlockListNetworkZone'
CreateEDNetworkZone:
$ref: '#/components/examples/CreateEDNZRequest'
schema:
$ref: '#/components/schemas/NetworkZone'
required: true
responses:
"200":
content:
application/json:
examples:
CreateIPPolicyNetworkZone:
$ref: '#/components/examples/CreateIPPolicyNetworkZoneResponse'
CreateIPPolicyBlocklistNetworkZone:
$ref: '#/components/examples/CreateIPPolicyBlockListNetworkZoneResponse'
CreateEDNetworkZone:
$ref: '#/components/examples/CreateEDNZResponse'
schema:
$ref: '#/components/schemas/NetworkZone'
description: Success
"400":
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/NzErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
"403":
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
"429":
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
security:
- apiToken: []
- oauth2:
- okta.networkZones.manage
summary: Create a Network Zone
tags:
- NetworkZone
x-codegen-request-body-name: zone
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
x-content-type: application/json
x-accepts:
- application/json
/api/v1/zones/{zoneId}:
delete:
description: |-
Deletes a Network Zone by `zoneId`
> **Notes:**
> * You can't delete a Network Zone that's used by a [Policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) or [Rule](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/#tag/Policy/operation/listPolicyRules).
> * For Okta Identity Engine orgs, you can't delete a Network Zone with an ACTIVE `status`. Bonjour ${user.profile.firstName}. Activer le compte
"
isDefault: false
CreateUpdateEmailCustomizationResponse:
value:
language: fr
subject: "Bienvenue dans ${org.name}!"
body: "Bonjour ${user.profile.firstName}. Activer le compte
"
isDefault: false
id: oel11u6DqUiMbQkpl0g4
created: 2021-11-09T20:38:10.000Z
lastUpdated: 2021-11-11T20:38:10.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4"
hints:
allow:
- GET
- PUT
- DELETE
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
preview:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview"
hints:
allow:
- GET
test:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test"
hints:
allow:
- POST
CreateUpdateIamRolePermissionRequestExampleWithExclude:
value:
conditions:
exclude:
okta:ResourceAttribute/User/Profile:
- zipCode
CreateUpdateIamRolePermissionRequestExampleWithInclude:
value:
conditions:
include:
okta:ResourceAttribute/User/Profile:
- city
- state
CreateUserRequest:
summary: Create a user type request
value:
description: A new custom user type
displayName: New User Type
name: newUserType
CreateUserResponse:
summary: Create a user type response
value:
id: otyfnly5cQjJT9PnR0g4
displayName: New User Type
name: newUserType
description: A new custom user type
createdBy: sprz9fj1ycBcsgopy1d6
lastUpdatedBy: sprz9fj1ycBcsgopy1d6
created: 2021-07-05T20:40:38.000Z
lastUpdated: 2021-07-05T20:40:38.000Z
default: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
CsrJsonResponse:
summary: CSR object in JSON format
value:
id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50
created: 2017-03-28T01:11:10.000Z
csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
kty: RSA
_links:
self:
href: "https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50"
hints:
allow:
- GET
- DELETE
publish:
href: "https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish"
hints:
allow:
- POST
CsrPkcs10Response:
summary: CSR in DER format
value: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9
CustomRoleAssignmentRequest:
value:
type: CUSTOM
role: cr04cxy6yzSCtNciD0g7
resource-set: iam4cxy6z7hhaZCSk0g7
CustomRoleResponseClient:
value:
id: irb4ey26fpFI3vQ8y0g7
label: view_minimal
type: CUSTOM
status: ACTIVE
created: 2023-05-01T15:16:47.000Z
lastUpdated: 2023-05-01T15:16:47.000Z
assignmentType: CLIENT
resource-set: iam4cxy6z7hhaZCSk0g7
role: cr04cxy6yzSCtNciD0g7
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr04cxy6yzSCtNciD0g7"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iam4cxy6z7hhaZCSk0g7"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr04cxy6yzSCtNciD0g7/permissions"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iam4cxy6z7hhaZCSk0g7/bindings/cr04cxy6yzSCtNciD0g7/members/irb4ey26fpFI3vQ8y0g7"
assignee:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0oa4ee9vgbIuqTUvd0g7"
CustomRoleResponseUser:
value:
id: irb1q92TFAHzySt3x0g4
role: cr0Yq6IJxGIr0ouum0g3
label: UserCreatorRole
type: CUSTOM
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: USER
resource-set: iamoJDFKaJxGIr0oamd9g
_links:
assignee:
href": "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions"
CustomRolesListResponseClient:
value:
- id: irb4ey26fpFI3vQ8y0g7
label: view_minimal
type: CUSTOM
status: ACTIVE
created: 2023-05-01T15:16:47.000Z
lastUpdated: 2023-05-01T15:16:47.000Z
assignmentType: CLIENT
resource-set: iam4cxy6z7hhaZCSk0g7
role: cr04cxy6yzSCtNciD0g7
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr04cxy6yzSCtNciD0g7"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iam4cxy6z7hhaZCSk0g7"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr04cxy6yzSCtNciD0g7/permissions"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iam4cxy6z7hhaZCSk0g7/bindings/cr04cxy6yzSCtNciD0g7/members/irb4ey26fpFI3vQ8y0g7"
assignee:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0oa4ee9vgbIuqTUvd0g7"
CustomRolesListResponseGroup:
value:
- id: irb1q92TFAHzySt3x0g4
role: cr0Yq6IJxGIr0ouum0g3
label: UserCreatorRole
type: CUSTOM
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: GROUP
resource-set: iamoJDFKaJxGIr0oamd9g
_links:
assignee:
href": "https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions"
DeactivateIdPResponse:
summary: Deactivate an Identity Provider
value:
id: 0oa62bfdiumsUndnZ0h7
type: GOOGLE
name: Google
status: INACTIVE
created: 2016-03-24T23:21:49.000Z
lastUpdated: 2016-03-25T19:16:53.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://accounts.google.com/o/oauth2/auth
binding: HTTP-REDIRECT
token:
url: https://www.googleapis.com/oauth2/v3/token
binding: HTTP-POST
scopes:
- profile
- email
- openid
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: |-
https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&
client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
scope={scopes}&redirect_uri={redirectUri}&state={state}
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
DeactivateNetworkZone:
summary: Deactivated Network Zone
value:
type: IP
id: nzowc1U5Jh5xuAK0o0g3
name: MyIpZone
status: INACTIVE
usage: POLICY
created: 2021-06-24T20:37:32.000Z
lastUpdated: 2021-06-24T20:37:32.000Z
system: false
gateways:
- type: CIDR
value: 1.2.3.4/24
proxies:
- type: RANGE
value: 3.3.4.5-3.3.4.15
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3"
hints:
allow:
- GET
- PUT
- DELETE
activate:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3/lifecycle/activate"
hints:
allow:
- POST
DeactivatedSecurityEventsProviderResponse:
summary: Inactive Security Events Provider
value:
id: sse1qg25RpusjUP6m0g5
name: Security Events Provider with well-known URL
type: okta
status: INACTIVE
settings:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
issuer: Issuer
jwks_url: https://example.okta.com/jwks/path
_links:
self:
href: https://example.okta.com/api/v1/security-events-providers/sse1qg25RpusjUP6m0g5
hints:
allow:
- GET
- PUT
- DELETE
activate:
href: https://example.okta.com/api/v1/security-events-providers/sse1qg25RpusjUP6m0g5/lifecycle/activate
hints:
allow:
- POST
DefaultEnhancedDynamicNetworkZone:
summary: Default Enhanced Dynamic Network Zone
value:
type: DYNAMIC_V2
id: nzohcnxFrSgsiwyHp0g4
name: DefaultEnhancedDynamicZone
status: ACTIVE
usage: BLOCKLIST
created: 2024-05-06T19:12:29.000Z
lastUpdated: 2024-05-09T21:02:31.000Z
system: true
locations:
include: []
exclude: []
ipServiceCategories:
include:
- ALL_ANONYMIZERS
exclue: []
asns:
include: []
exclude: []
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6/lifecycle/deactivate"
hints:
allow:
- POST
DefaultIpBlocklistNetworkZone:
summary: Default IP Blocklist Network Zone
value:
type: IP
id: nzou3u0stMCmgOzXK1d6
name: BlockedIpZone
status: ACTIVE
usage: BLOCKLIST
created: 2021-06-09T21:32:46.000Z
lastUpdated: 2021-06-09T21:32:46.000Z
system: true
gateways: null
proxies: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6/lifecycle/deactivate"
hints:
allow:
- POST
DefaultIpNetworkZone:
summary: Default IP Network Zone
value:
type: IP
id: nzou3u0ssJfZjYsWL1d6
name: LegacyIpZone
status: ACTIVE
usage: POLICY
created: 2021-06-09T21:32:46.000Z
lastUpdated: 2021-06-09T21:32:46.000Z
system: true
gateways: null
proxies: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0ssJfZjYsWL1d6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0ssJfZjYsWL1d6/lifecycle/deactivate"
hints:
allow:
- POST
DefaultRealmAssignment:
value:
id: rul2jy7jLUlnO5ng00g4
status: ACTIVE
name: Catch-all
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: true
conditions:
profileSourceId: "0oa4enoRyjwSCy6hx0g4,"
expression:
value: string
actions:
assignUserToRealm:
realmId: 00g1b7rvh0xPLKXFf2g5
priority: 499
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realm-assignments/rul2jy7jLUlnO5ng00g4
method: GET
DefaultRealmResponse:
value:
id: guox9jQ16k9V8IQWL0g3
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: true
profile:
name: Default Realm
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realms/guox9jQ16k9V8IQWL0g3
method: GET
DeviceAssuranceAndroidRequest:
summary: Android request
value:
name: Device Assurance Android
osVersion:
minimum: 12
diskEncryptionType:
include:
- USER
- FULL
jailbreak: false
platform: ANDROID
screenLockType:
include:
- BIOMETRIC
secureHardwarePresent: true
DeviceAssuranceAndroidResponse:
summary: Android response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Android
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
minimum: 12.4.5
diskEncryptionType:
include:
- USER
- FULL
jailbreak: false
platform: ANDROID
screenLockType:
include:
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
DeviceAssuranceAndroidWithDynamicVersionRequirementRequest:
summary: Android with dynamic version requirement request
value:
name: Device Assurance Android
osVersion:
dynamicVersionRequirement:
type: MINIMUM
distanceFromLatestMajor: 0
diskEncryptionType:
include:
- USER
- FULL
jailbreak: false
platform: ANDROID
screenLockType:
include:
- BIOMETRIC
secureHardwarePresent: true
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceAndroidWithDynamicVersionRequirementResponse:
summary: Android with dynamic version requirement response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Android
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
dynamicVersionRequirement:
type: MINIMUM
distanceFromLatestMajor: 0
diskEncryptionType:
include:
- USER
- FULL
jailbreak: false
platform: ANDROID
screenLockType:
include:
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceChromeOSWithThirdPartySignalProvidersRequest:
summary: ChromeOS with third-party signal providers request
value:
name: Device Assurance ChromeOS
platform: CHROMEOS
thirdPartySignalProviders:
dtc:
osVersion:
minimum: 10.0.19041.1110
diskEncrypted: true
osFirewall: true
screenLockSecured: true
allowScreenLock: true
browserVersion:
minimum: 15393.27.0
deviceEnrollmentDomain: testDomain
builtInDnsClientEnabled: true
chromeRemoteDesktopAppBlocked: true
safeBrowsingProtectionLevel: ENHANCED_PROTECTION
siteIsolationEnabled: true
passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF
realtimeUrlCheckMode: true
keyTrustLevel: CHROME_OS_VERIFIED_MODE
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceChromeOSWithThirdPartySignalProvidersResponse:
summary: ChromeOS with third-party signal providers response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance ChromeOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
platform: CHROMEOS
thirdPartySignalProviders:
dtc:
osVersion:
minimum: 10.0.19041.1110
diskEncrypted: true
osFirewall: true
screenLockSecured: true
allowScreenLock: true
browserVersion:
minimum: 15393.27.0
deviceEnrollmentDomain: testDomain
builtInDnsClientEnabled: true
chromeRemoteDesktopAppBlocked: true
safeBrowsingProtectionLevel: ENHANCED_PROTECTION
siteIsolationEnabled: true
passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF
realtimeUrlCheckMode: true
keyTrustLevel: CHROME_OS_VERIFIED_MODE
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceIosRequest:
summary: iOS request
value:
name: Device Assurance iOS
osVersion:
minimum: 12.4.5
jailbreak: false
platform: IOS
screenLockType:
include:
- BIOMETRIC
DeviceAssuranceIosResponse:
summary: iOS response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance iOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
minimum: 12.4.5.9
jailbroken: false
platform: IOS
screenLockType:
include:
- BIOMETRIC
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
DeviceAssuranceIosWithDynamicVersionRequirementRequest:
summary: iOS with dynamic version requirement request
value:
name: Device Assurance iOS
osVersion:
dynamicVersionRequirement:
type: EXACT_ANY_SUPPORTED
latestSecurityPatch: true
jailbreak: false
platform: IOS
screenLockType:
include:
- BIOMETRIC
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceIosWithDynamicVersionRequirementResponse:
summary: iOS with dynamic version requirement response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance iOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
dynamicVersionRequirement:
type: EXACT_ANY_SUPPORTED
latestSecurityPatch: true
jailbroken: false
platform: IOS
screenLockType:
include:
- BIOMETRIC
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceMacOSRequest:
summary: macOS request
value:
name: Device Assurance macOS
osVersion:
minimum: 12.4.5
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: MACOS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
DeviceAssuranceMacOSResponse:
summary: macOS response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance macOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
minimum: 12.4.5
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: MACOS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
DeviceAssuranceMacOSWithDynamicVersionRequirementRequest:
summary: macOS with dynamic version requirement request
value:
name: Device Assurance macOS
osVersion:
dynamicVersionRequirement:
type: EXACT
distanceFromLatestMajor: 0
latestSecurityPatch: true
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: MACOS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceMacOSWithDynamicVersionRequirementResponse:
summary: macOS with dynamic version requirement response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance macOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
dynamicVersionRequirement:
type: EXACT
distanceFromLatestMajor: 0
latestSecurityPatch: true
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: MACOS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceMacOSWithThirdPartySignalProvidersRequest:
summary: macOS with third-party signal providers request
value:
name: Device Assurance macOS
osVersion:
minimum: 12.4.5
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: MACOS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
thirdPartySignalProviders:
dtc:
osVersion:
minimum: 10.0.19041.1110
diskEncrypted: true
osFirewall: true
screenLockSecured: true
browserVersion:
minimum: 15393.27.0
deviceEnrollmentDomain": testDomain
builtInDnsClientEnabled": true
chromeRemoteDesktopAppBlocked": true
safeBrowsingProtectionLevel": true
siteIsolationEnabled": true
passwordProtectionWarningTrigger": PASSWORD_PROTECTION_OFF
realtimeUrlCheckMode": true
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceMacOSWithThirdPartySignalProvidersResponse:
summary: macOS with third-party signal providers response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance macOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
minimum: 12.4.5.9
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: MACOS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
thirdPartySignalProviders:
dtc:
osVersion:
minimum: 10.0.19041.1110
diskEncrypted: true
osFirewall: true
screenLockSecured: true
browserVersion:
minimum: 15393.27.0
deviceEnrollmentDomain: testDomain
builtInDnsClientEnabled: true
chromeRemoteDesktopAppBlocked: true
safeBrowsingProtectionLevel: ENHANCED_PROTECTION
siteIsolationEnabled: true
passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF
realtimeUrlCheckMode: true
keyTrustLevel: CHROME_BROWSER_HW_KEY
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsRequest:
summary: Windows request
value:
name: Device Assurance Windows
osVersion:
minimum: 12.4.5.9
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
DeviceAssuranceWindowsResponse:
summary: Windows response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Windows
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
minimum: 12.4.5.9
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
DeviceAssuranceWindowsWithDynamicVersionRequirementsRequest:
summary: Windows with Windows 11 and Windows 10 dynamic version requirements
request
value:
name: Device Assurance Windows
osVersionConstraints:
- majorVersionConstraint: WINDOWS_11
dynamicVersionRequirement:
type: MINIMUM
distanceFromLatestMajor: 1
latestSecurityPatch: true
- majorVersionConstraint: WINDOWS_10
dynamicVersionRequirement:
type: EXACT_ANY_SUPPORTED
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithDynamicVersionRequirementsResponse:
summary: Windows with Windows 11 and Windows 10 dynamic version requirements
response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Windows
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersionConstraints:
- majorVersionConstraint: WINDOWS_11
dynamicVersionRequirement:
type: MINIMUM
distanceFromLatestMajor: 1
latestSecurityPatch: true
- majorVersionConstraint: WINDOWS_10
dynamicVersionRequirement:
type: EXACT_ANY_SUPPORTED
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithThirdPartySignalProvidersRequest:
summary: Windows with third-party signal providers request
value:
name: Device Assurance Windows
osVersion:
minimum: 12.4.5.9
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
thirdPartySignalProviders:
dtc:
osVersion:
minimum: 10.0.19041.1110
diskEncrypted: true
osFirewall: true
screenLockSecured: true
browserVersion:
minimum: 15393.27.0
deviceEnrollmentDomain: testDomain
builtInDnsClientEnabled: true
chromeRemoteDesktopAppBlocked: true
safeBrowsingProtectionLevel: ENHANCED_PROTECTION
siteIsolationEnabled: true
passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF
realtimeUrlCheckMode: true
secureBootEnabled: true
windowsMachineDomain: testMachineDomain
windowsUserDomain: testUserDomain
thirdPartyBlockingEnabled: true
crowdStrikeCustomerId: testCustomerId
crowdStrikeAgentId": testAgentId
keyTrustLevel: CHROME_BROWSER_HW_KEY
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithThirdPartySignalProvidersResponse:
summary: Windows with third-party signal providers response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Windows
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersion:
minimum: 12.4.5.9
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
thirdPartySignalProviders:
dtc:
osVersion:
minimum: 10.0.19041.1110
diskEncrypted: true
osFirewall: true
screenLockSecured: true
browserVersion:
minimum: 15393.27.0
deviceEnrollmentDomain: testDomain
builtInDnsClientEnabled: true
chromeRemoteDesktopAppBlocked: true
safeBrowsingProtectionLevel: ENHANCED_PROTECTION
siteIsolationEnabled: true
passwordProtectionWarningTrigger: PASSWORD_PROTECTION_OFF
realtimeUrlCheckMode: true
secureBootEnabled: true
windowsMachineDomain: testMachineDomain
windowsUserDomain: testUserDomain
thirdPartyBlockingEnabled: true
crowdStrikeCustomerId: testCustomerId
crowdStrikeAgentId": testAgentId
keyTrustLevel: CHROME_BROWSER_HW_KEY
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithWin11DynamicVersionRequirementAndWin10MinimumVersionStringRequest:
summary: Windows with Windows 11 dynamic version requirement and Windows 10
minimum version request
value:
name: Device Assurance Windows
osVersionConstraints:
- majorVersionConstraint: WINDOWS_11
dynamicVersionRequirement:
type: EXACT
distanceFromLatestMajor: 1
- majorVersionConstraint: WINDOWS_10
minimum: 10.0.19045.0
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithWin11DynamicVersionRequirementAndWin10MinimumVersionStringResponse:
summary: Windows with Windows 11 dynamic version requirement and Windows 10
minimum version response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Windows
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersionConstraints:
- majorVersionConstraint: WINDOWS_11
dynamicVersionRequirement:
type: EXACT
distanceFromLatestMajor: 1
- majorVersionConstraint: WINDOWS_10
minimum: 10.0.19045.0
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithWin11MinimumVersionStringAndWin10DynamicVersionRequirementRequest:
summary: Windows with Windows 11 minimum version and a Windows 10 dynamic version
requirement request
value:
name: Device Assurance Windows
osVersionConstraints:
- majorVersionConstraint: WINDOWS_11
minimum: 10.0.22000.0
- majorVersionConstraint: WINDOWS_10
dynamicVersionRequirement:
type: NOT_ALLOWED
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsWithWin11MinimumVersionStringAndWin10DynamicVersionRequirementResponse:
summary: Windows with Windows 11 minimum version and Windows 10 dynamic version
requirement response
value:
id: dae3m8o4rWhwReDeM1c5
name: Device Assurance Windows
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
osVersionConstraints:
- majorVersionConstraint: WINDOWS_11
minimum: 10.0.22000.0
- majorVersionConstraint: WINDOWS_10
dynamicVersionRequirement:
type: NOT_ALLOWED
diskEncryptionType:
include:
- ALL_INTERNAL_VOLUMES
platform: WINDOWS
screenLockType:
include:
- PASSCODE
- BIOMETRIC
secureHardwarePresent: true
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-assurances/dae3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
DeviceChecksMacOSRequest:
summary: macOS request
value:
name: Device Check macOS
description: Query macOS devices to check if firewall is enabled
variableName: macOSFirewall
platform: MACOS
query: SELECT CASE WHEN global_state = 0 THEN 0 ELSE 1 END AS firewall_enabled
FROM alf;
DeviceChecksMacOSResponse:
summary: macOS response
value:
id: dch3m8o4rWhwReDeM1c5
name: Device Check macOS
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
description: Query macOS devices to check if firewall is enabled
variableName: macOSFirewall
query: SELECT CASE WHEN global_state = 0 THEN 0 ELSE 1 END AS firewall_enabled
FROM alf;
platform: MACOS
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-checks/dch3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
DeviceChecksWindowsRequest:
summary: Windows request
value:
name: Device Check Windows
description: Query Windows devices to check if firewall is enabled
variableName: windowsFirewall
platform: WINDOWS
query: SELECT CASE WHEN enabled = 1 THEN 1 ELSE 0 END AS firewall_enabled
FROM windows_firewall_profiles;
DeviceChecksWindowsResponse:
summary: Windows response
value:
id: dch3m8o4rWhwReDeM1c5
name: Device Check Windows
lastUpdate: 2022-01-01T00:00:00.000Z
createdUpdate: 2022-01-01T00:00:00.000Z
lastUpdatedBy: 00u217pyf72CdUrBt1c5
createdBy: 00u217pyf72CdUrBt1c5
description: Query Windows devices to check if firewall is enabled
variableName: windowsFirewall
query: SELECT CASE WHEN enabled = 1 THEN 1 ELSE 0 END AS firewall_enabled
FROM windows_firewall_profiles;
platform: WINDOWS
_links:
self:
href: https://your-subdomain.okta.com/api/v1/device-checks/dch3m8o4rWhwReDeM1c5
hints:
allow:
- DELETE
- GET
- PUT
DeviceResponse:
value:
id: guo8jx5vVoxfvJeLb0w4
status: ACTIVE
created: 2020-11-03T21:47:01.000Z
lastUpdated: 2020-11-03T23:46:27.000Z
profile:
displayName: DESKTOP-EHAD3IE
platform: WINDOWS
manufacturer: International Corp
model: "VMware7,1"
osVersion: 10.0.18362
serialNumber: 56 4d 4f 95 74 c5 d3 e7-fc 3a 57 9c c2 f8 5d ce
udid: 954F4D56-C574-E7D3-FC3A-579CC2F85DCE
sid: S-1-5-21-3992267483-1860856704-2413701314-500
registered: true
secureHardwarePresent: false
diskEncryptionType: NONE
resourceId: guo8jx5vVoxfvJeLb0w4
resourceDisplayName:
value: DESKTOP-EHAD3IE
sensitive: false
resourceType: UDDevice
resourceAlternateId: null
_links:
suspend:
href: "https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/suspend"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4"
hints:
allow:
- GET
- PATCH
- PUT
users:
href: "https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/users"
hints:
allow:
- GET
deactivate:
href: "https://{yourOktaDomain}/api/v1/devices/guo8jx5vVoxfvJeLb0w4/lifecycle/deactivate"
hints:
allow:
- POST
EmailCustomizationResponse:
value:
language: en
isDefault: true
subject: "Welcome to ${org.name}!"
body: "Hello, ${user.profile.firstName}. Click\
\ here to activate your account."
id: oel11u6DqUiMbQkpl0g4
created: 2021-11-09T20:38:10.000Z
lastUpdated: 2021-11-11T20:38:10.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4"
hints:
allow:
- GET
- PUT
- DELETE
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
preview:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview"
hints:
allow:
- GET
test:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test"
hints:
allow:
- POST
EmailDomainResponse:
value:
id: OeD114iNkrcN6aR680g4
validationStatus: NOT_STARTED
displayName: Admin
userName: admin
domain: example.com
validationSubdomain: mail
dnsValidationRecords:
- recordType: TXT
fqdn: _oktaverification.example.com
verificationValue: 759080212bda43e3bc825a7d73b4bb64
- recordType: CNAME
fqdn: mail.example.com
verificationValue: u22224444.wl024.sendgrid.net
- recordType: CNAME
fqdn: t02._domainkey.example.com
verificationValue: t02.domainkey.u22224444.wl024.sendgrid.net
- recordType: CNAME
fqdn: t022._domainkey.example.com
verificationValue: t02.domainkey.u22224444.wl024.sendgrid.net
EmailSettingsRequest:
value:
recipients: ALL_USERS
EmailSettingsResponse:
value:
recipients: ALL_USERS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings"
hints:
allow:
- GET
- PUT
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
EmailTemplateDefaultContentResponse:
value:
subject: "Welcome to ${org.name}!"
body: "
Hello, ${user.profile.firstName}. Click\
\ here to activate your account."
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content"
hints:
allow:
- GET
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
preview:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content/preview"
hints:
allow:
- GET
EmbeddedGroupAssignmentSampleResponse:
summary: Application Group with an embedded Group
value:
id: 00g15acRUy0SYb9GT0g4
priority: 0
lastUpdated: 2024-06-02T13:17:57.000Z
profile:
preferredLanguage: English
manager: Donald Glover
securityQuestion: Who is the footballer to have played the game
securityAnswer: Ronaldinho
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: wazobia
userType: null
department: marketing
_links:
app:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4"
self:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4"
group:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4"
_embedded:
group:
id: 00g15acRUy0SYb9GT0g4
created: 2024-06-02T13:02:12.000Z
lastUpdated: 2024-06-02T13:02:12.000Z
lastMembershipUpdated: 2024-06-02T13:03:13.000Z
objectClass:
- okta:user_group
type: OKTA_GROUP
profile:
name: Football Group
description: Group with professional footballers
_links:
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/groups/odyssey/okta-medium.30ce6d4085dff29412984e4c191bc874.png"
type: image/png
- name: large
href: "http://{yourOktaDomain}/assets/img/logos/groups/odyssey/okta-large.c3cb8cda8ae0add1b4fe928f5844dbe3.png"
type: image/png
users:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4/users"
apps:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4/apps"
EmbeddedMetadataGroupAssignmentSampleResponse:
summary: Application Group with embedded metadata
value:
id: 00g15acRUy0SYb9GT0g4
priority: 0
lastUpdated: 2024-06-02T13:17:57.000Z
profile:
preferredLanguage: English
manager: Donald Glover
securityQuestion: Who is the footballer to have played the game
securityAnswer: Ronaldinho
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: wazobia
userType: null
department: marketing
_links:
app:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4"
self:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4"
group:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4"
_embedded:
metadata:
credentials: {}
profile:
division:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
preferredLanguage:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
manager:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
securityQuestion:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
securityAnswer:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
timezone:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
organization:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
initialStatus:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
managerId:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
userType:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
locale:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
department:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
EnrollFactorCallRequest:
summary: call
value:
factorType: call
provider: OKTA
profile:
phoneNumber: +1-555-415-1337
honeExtension: "1234"
EnrollFactorCallResponse:
summary: call
value:
id: clf1nz9JHJGHWRKMTLHP
factorType: call
provider: OKTA
vendorName: OKTA
status: PENDING_ACTIVATION
created: 2014-08-05T20:59:49.000Z
lastUpdated: 2014-08-06T03:59:49.000Z
profile:
phoneNumber: +1-555-415-1337
phoneExtension: "1234"
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP/lifecycle/activate"
hints:
allow:
- POST
resend:
- name: call
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP/resend"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clf1nz9JHJGHWRKMTLHP"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
EnrollFactorCustomTotpRequest:
summary: custom totp
value:
factorType: token:hotp
provider: CUSTOM
factorProfileId: fpr20l2mDyaUGWGCa0g4
profile:
sharedSecret: 484f97be3213b117e3a20438e291540a
EnrollFactorCustomTotpResponse:
summary: custom totp
value:
id: chf20l33Ks8U2Zjba0g4
factorType: token:hotp
provider: CUSTOM
vendorName: Entrust Datacard
status: ACTIVE
created: 2019-07-22T23:22:36.000Z
lastUpdated: 2019-07-22T23:22:36.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3/factors/chf20l33Ks8U2Zjba0g4"
hints:
allow:
- GET
- DELETE
verify:
href: "https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3/factors/chf20l33Ks8U2Zjba0g4/verify"
hints:
allow:
- POST
user:
href: "https://{yourOktaDomain}/api/v1/users/00utf43LCCmTJVcsK0g3"
hints:
allow:
- GET
EnrollFactorEmailRequest:
summary: email
value:
factorType: email
provider: OKTA
profile:
email: [email protected]
EnrollFactorEmailResponse:
summary: email
value:
id: emfnf3gSScB8xXoXK0g3
factorType: email
provider: OKTA
vendorName: OKTA
status: PENDING_ACTIVATION
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/lifecycle/activate"
hints:
allow:
- POST
resend:
- name: email
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/resend"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3"
hints:
allow:
- GET
EnrollFactorGoogleRequest:
summary: google token:software:totp
value:
factorType: token:software:totp
provider: GOOGLE
EnrollFactorGoogleResponse:
value:
id: ostf1fmaMGJLMNGNLIVG
factorType: token:software:totp
provider: GOOGLE
vendorName: GOOGLE
status: PENDING_ACTIVATION
created: 2014-07-16T16:13:56.000Z
lastUpdated: 2014-07-16T16:13:56.000Z
profile:
credentialId: [email protected]
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/lifecycle/activate"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
_embedded:
activation:
timeStep: 30
sharedSecret: JBTWGV22G4ZGKV3N
encoding: base32
keyLength: 16
_links:
qrcode:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/qr/00fukNElRS_Tz6k-CFhg3pH4KO2dj2guhmaapXWbc4"
type: image/png
EnrollFactorOVPushRequest:
summary: token:software:totp push
value:
factorType: push
provider: OKTA
EnrollFactorOVPushResponse:
summary: token:software:totp
value:
id: opfbtzzrjgwauUsxO0g4
factorType: push
provider: OKTA
vendorName: OKTA
status: PENDING_ACTIVATION
created: 2015-11-13T07:34:22.000Z
lastUpdated: 2015-11-13T07:34:22.000Z
_links:
poll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/poll"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
_embedded:
activation:
expiresAt: 2015-11-13T07:44:22.000Z
factorResult: WAITING
_links:
send:
- name: email
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/email"
hints:
allow:
- POST
- name: sms
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/lifecycle/activate/sms"
hints:
allow:
- POST
qrcode:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfbtzzrjgwauUsxO0g4/qr/00Ji8qVBNJD4LmjYy1WZO2VbNqvvPdaCVua-1qjypa"
type: image/png
EnrollFactorOVTotpRequest:
summary: token:software:totp
value:
factorType: token:software:totp
provider: OKTA
EnrollFactorOVTotpResponse:
summary: token:software:totp
value:
id: ostf1fmaMGJLMNGNLIVG
factorType: token:software:totp
provider: OKTA
vendorName: OKTA
status: PENDING_ACTIVATION
created: 2014-07-16T16:13:56.000Z
lastUpdated: 2014-07-16T16:13:56.000Z
profile:
credentialId: [email protected]
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/lifecycle/activate"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
_embedded:
activation:
timeStep: 30
sharedSecret: JBTWGV22G4ZGKV3N
encoding: base32
keyLength: 6
_links:
qrcode:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf1fmaMGJLMNGNLIVG/qr/00fukNElRS_Tz6k-CFhg3pH4KO2dj2guhmaapXWbc4"
type: image/png
EnrollFactorQuestionRequest:
summary: question
value:
question:
summary: question factor
value:
factorType: question
provider: OKTA
profile:
question: disliked_food
answer: mayonnaise
EnrollFactorQuestionResponse:
summary: question
value:
id: ufs1o01OTMGHLAJPVHDZ
factorType: question
provider: OKTA
vendorName: OKTA
status: ACTIVE
created: 2014-08-05T22:58:49.000Z
lastUpdated: 2014-08-05T22:58:49.000Z
profile:
question: disliked_food
questionText: What is the food you least liked as a child?
_links:
questions:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions"
hints:
allow:
- GET
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufs1o01OTMGHLAJPVHDZ"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
EnrollFactorRsaSecurIdRequest:
summary: RSA SecurID
value:
factorType: token
provider: RSA
profile:
credentialId: [email protected]
verify:
passCode: "5275875498"
EnrollFactorRsaSecurIdResponse:
summary: RSA SecurID
value:
id: rsabtznMn6cp94ez20g4
factorType: token
provider: RSA
vendorName: RSA
status: ACTIVE
created: 2015-11-13T07:05:53.000Z
lastUpdated: 2015-11-13T07:05:53.000Z
profile:
credentialId: [email protected]
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/rsabtznMn6cp94ez20g4/verify"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/rsabtznMn6cp94ez20g4"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
EnrollFactorSmsRequest:
summary: sms
value:
factorType: sms
provider: OKTA
profile:
phoneNumber: +1-555-415-1337
EnrollFactorSmsResponse:
summary: sms
value:
id: mbl1nz9JHJGHWRKMTLHP
factorType: sms
provider: OKTA
vendorName: OKTA
status: PENDING_ACTIVATION
created: 2014-08-05T20:59:49.000Z
lastUpdated: 2014-08-06T03:59:49.000Z
profile:
phoneNumber: +1-555-415-1337
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP/lifecycle/activate"
hints:
allow:
- POST
resend:
- name: sms
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP/resend"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/mbl1nz9JHJGHWRKMTLHP"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
EnrollFactorSymantecVipRequest:
summary: Symantec VIP
value:
factorType: token
provider: SYMANTEC
profile:
credentialId: VSMT14393584
verify:
passCode: "875498"
nextPassCode: "678195"
EnrollFactorSymantecVipResponse:
summary: Symantec VIP
value:
id: ufvbtzgkYaA7zTKdQ0g4
factorType: token
provider: SYMANTEC
vendorName: SYMANTEC
status: ACTIVE
created: 2015-11-13T06:52:08.000Z
lastUpdated: 2015-11-13T06:52:08.000Z
profile:
credentialId: VSMT14393584
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufvbtzgkYaA7zTKdQ0g4/verify"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufvbtzgkYaA7zTKdQ0g4"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
EnrollFactorU2fRequest:
summary: u2f
value:
factorType: u2f
provider: FIDO
EnrollFactorU2fResponse:
summary: u2f
value:
id: fuf2rovRxogXJ0nDy0g4
factorType: u2f
provider: FIDO
vendorName: FIDO
status: PENDING_ACTIVATION
created: 2018-05-24T20:43:19.000Z
lastUpdated: 2018-05-24T20:43:19.000Z
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/lifecycle/activate"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
_embedded:
activation:
version: U2F_V2
nonce: 9DmGJDLvaU6KWxJbfrZ0
timeoutSeconds: 20
EnrollFactorWebauthnRequest:
summary: webAuthn
value:
factorType: webauthn
provider: FIDO
EnrollFactorWebauthnResponse:
summary: webAuthn
value:
id: fwf2rovRxogXJ0nDy0g4
factorType: webauthn
provider: FIDO
vendorName: FIDO
status: PENDING_ACTIVATION
created: 2018-05-24T20:43:19.000Z
lastUpdated: 2018-05-24T20:43:19.000Z
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/lifecycle/activate"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
_embedded:
activation:
attestation: direct
authenticatorSelection:
userVerification: preferred
requireResidentKey: false
challenge: cdsZ1V10E0BGE4GcG3IK
excludeCredentials: []
pubKeyCredParams:
- type: public-key
alg: -7
- type: public-key
alg: -257
rp:
name: Rain-Cloud59
user:
displayName: First Last
name: [email protected]
id: 00u15s1KDETTQMQYABRL
EnrollFactorYubikeyRequest:
summary: yubikey
value:
factorType: token:hardware
provider: YUBICO
verify:
passCode: cccccceukngdfgkukfctkcvfidnetljjiknckkcjulji
EnrollFactorYubikeyResponse:
value:
id: ykfbty3BJeBgUi3750g4
factorType: token:hardware
provider: YUBICO
vendorName: YUBICO
status: ACTIVE
created: 2015-11-13T05:27:49.000Z
lastUpdated: 2015-11-13T05:27:49.000Z
profile:
credentialId: "000004102994"
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ykfbty3BJeBgUi3750g4/verify"
hints:
allow:
- POST
self:
href: "hhttps://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ykfbty3BJeBgUi3750g4"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
EntitlementValuesResponse:
summary: List of bundle entitlement values
value:
entitlementValues:
- id: entfxqCAJWWGELFTYAAA
value: orn:okta:00o5rb5mt2H3d1TJd0h7:groups:00guaxWZ0AOa5NFAj0g3
name: Restricted users group
_links:
group: http://your-subdomain.okta.com/api/v1/groups/00guaxWZ0AOa5NFAj0g3
_links:
self:
href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10
bundle:
href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA
entitlements:
href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements
ErrorAccessDenied:
summary: Access Denied
value:
errorCode: E0000006
errorSummary: You do not have permission to perform the requested action
errorLink: E0000006
errorId: sampleNUSD_8fdkFd8fs8SDBK
errorCauses: []
ErrorAgentTimeOut:
value:
errorCode: E0000237
errorSummary: Timed out waiting for agent.
errorLink: E0000237
errorId: sampleMlLvGUj_YD5v16vkYWY
errorCauses: []
ErrorApiValidationFailed:
summary: API Validation Failed
value:
errorCode: E0000001
errorSummary: "Api validation failed: {0}"
errorLink: E0000001
errorId: sampleiCF-8D5rLW6myqiPItW
errorCauses: []
ErrorAppFeatureAPIValidationFailed:
summary: API Validation Failed
value:
errorCode: E0000001
errorSummary: "Api validation failed: feature"
errorLink: E0000001
errorId: oaeZLxeiHUUQomPkM8xOqvu1A
errorCauses:
- errorSummary: Provisioning is not enabled for the app instance.
ErrorAppUserForbiddenAction:
description: "If the `PUSH_NEW_USERS` or `PUSH_PROFILE_UPDATES` feature is enabled\
\ and the request specifies a value for a profile-mapped (Universal Directory)\
\ attribute that doesn't match the mapped value, then a 403 error is returned."
summary: Forbidden action
value:
errorCode: E0000075
errorSummary: Cannot modify the firstName attribute because it has a field
mapping and profile push is enabled.
errorLink: E0000075
errorId: sampleWXiR_K-WwaTKhlgBQ
errorCauses: []
ErrorAppUserUpdateBadRequest:
description: "If you attempt to assign a username or password to an app with\
\ an incompatible authentication scheme, then a 400 error is returned."
summary: Bad request
value:
errorCode: E0000041
errorSummary: Credentials should not be set on this resource based on the
scheme.
errorLink: E0000041
errorId: oaeUM77NBynQQu4C_qT5ngjGQ
errorCauses:
errorSummary: User level credentials should not be provided for this scheme.
ErrorCAPTCHALimitOfOne:
value:
errorCode: E0000165
errorSummary: CAPTCHA count limit reached. At most one CAPTCHA instance is
allowed per Org.
errorLink: E0000165
errorId: oaejrB1fWL1S7mc-2KcG-SOtw
errorCauses: []
ErrorCAPTCHAOrgWideSetting:
value:
errorCode: E0000149
errorSummary: "Current CAPTCHA is associated with org-wide settings, cannot\
\ be removed."
errorLink: E0000149
errorId: samplezsusshPdiTWiITwqBt8
errorCauses: []
ErrorCAPTCHAOrgWideSettingNull:
summary: "captchaId is null, but enabledPages is defined"
value:
errorCode: E0000001
errorSummary: "Api validation failed: captchaId"
errorLink: E0000001
errorId: oae-hk3rssXQmOWDRsaFfxe8A
errorCauses:
errorSummary: "captchaId: Invalid CAPTCHA ID. The value of captchaId cannot\
\ be blank when enabledPages is not empty. Please resubmit with an existing\
\ CAPTCHA ID or disable CAPTCHA support on all supported pages."
ErrorClientJsonWebKeyDuplicateKid:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: All keys in the 'jwks' must have a unique `kid`.
ErrorClientJsonWebKeyKidLengthTooShort:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "RSA key length in the 'jwks' is less than '2,048' bits for\
\ the given key."
ErrorClientJsonWebKeyNonUniqueKid:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "Each key should have a unique kid when adding multiple keys.\
\ Use the Apps API to update the JWKS to add a kid for the existing key,\
\ or delete the existing key and re-add the key with a kid using the JWKS\
\ APIs."
ErrorClientJsonWebKeyTooManyKids:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "You can't create a new key. You have reached the maximum\
\ number of keys allowed (50). To add another key, you must first delete\
\ an existing one."
ErrorClientSecretNonAscii:
summary: Client secret allows only ASCII error
value:
errorCode: E0000001
errorSummary: "Api validation failed: client_secret"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "client_secret: ''client_secret'' must only contain printable\
\ ASCII: [x20-x7E]+"
ErrorClientSecretTooLong:
summary: Client secret too long error
value:
errorCode: E0000001
errorSummary: "Api validation failed: client_secret"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "client_secret: 'client_secret' can't be more than '100' characters\
\ long."
ErrorClientSecretTooShort:
summary: Client secret too short error
value:
errorCode: E0000001
errorSummary: "Api validation failed: client_secret"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "client_secret: 'client_secret' must be at least '14' characters\
\ long."
ErrorClientSecretTooShortWithClientSecretJWT:
summary: Client secret is too short for JWT error
value:
errorCode: E0000001
errorSummary: "Api validation failed: client_secret"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: "client_secret: 'client_secret' must be at least '32' characters\
\ long when 'token_endpoint_auth_method' is 'client_secret_jwt'."
ErrorClientSecretWithPrivateKeyJWT:
summary: Client secret can't be used for private key JWT error
value:
errorCode: E0000001
errorSummary: "Api validation failed: client_secret"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: '''client_secret'' can''t be used when ''token_endpoint_auth_method''
is ''private_key_jwt''.'
ErrorCreateBrandExists:
value:
errorCode: E0000202
errorSummary: Brand name already exists.
errorLink: E0000202
errorId: oaeKABuesTdRvCXeCTpSpXAcQ
errorCauses: []
ErrorCreateUserWithExpiredPasswordWithNullPassword:
value:
errorCode: E0000124
errorSummary: "Could not create User. To create a User and expire their password\
\ immediately, a password must be specified."
errorLink: E0000124
errorId: oaeXxuZgXBySvqi1FvtkwoYCA
errorCauses:
- errorSummary: "Could not create User. To create a User and expire their\
\ password immediately, a password must be specified."
ErrorCreateUserWithExpiredPasswordWithoutActivation:
value:
errorCode: E0000125
errorSummary: "Could not create User. To create a User and expire their password\
\ immediately, `activate` must be true."
errorLink: E0000125
errorId: oaeDd77L9R-TJaD7j_rXsQ31w
errorCauses:
- errorSummary: "Could not create User. To create a User and expire their\
\ password immediately, `activate` must be true."
ErrorCreateUserWithTooManyManyGroupsResponse:
value:
errorCode: E0000093
errorSummary: Target count limit exceeded
errorLink: E0000093
errorId: oaePVSLIYnIQsC0B-ptBIllVA
errorCauses:
- errorSummary: The number of group targets is too large
ErrorDeactivateTheOnlyClientSecret:
value:
errorCode: E0000001
errorSummary: "Api validation failed: OAuth2ClientSecretMediated"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: You can't deactivate the only active client secret.
ErrorDeactivateTheOnlyKeyWithPrivateKeyJwtAuthMethod:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: Can't deactivate the only active JSON Web Key when the value
for `token_endpoint_auth_method` is `private_key_jwt`.
ErrorDeactivateTheOnlyKeyWithRequestObjectSignAlgorithm:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: The `jwks` must contain at least one key with an algorithm
matching the `request_object_signature_algorithm`.
ErrorDeleteActiveJsonWebKey:
value:
errorCode: E0000001
errorSummary: "Api validation failed: JsonWebKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: You can't delete an active JSON Web key. Deactivate the key
before deleting it.
ErrorDeleteActiveSecret:
value:
errorCode: E0000001
errorSummary: "Api validation failed: OAuth2ClientSecretMediated"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: You can't delete an active client secret. Deactivate the secret
before deleting it.
ErrorDeleteBrandAssociatedWithDomain:
value:
errorCode: E0000201
errorSummary: A brand associated with a domain cannot be deleted
errorLink: E0000201
errorId: oaeAdRqprFuTyKokyYPbURJkA
errorCauses: []
ErrorDeleteDefaultBrand:
value:
errorCode: E0000200
errorSummary: A default brand cannot be deleted
errorLink: E0000200
errorId: oaeAdRqprFuTyKokyYPbURJkA
errorCauses: []
ErrorDeviceAssuranceInUse:
summary: Can't delete device assurance policy in use by authentication policies
value:
errorSummary: Device assurance is in use and cannot be deleted.
errorId: oaenwA1ra80S9W-pvbh4m6haA
errorCauses: []
ErrorDeviceCheckInUse:
summary: Can't delete device check in use by device assurance policies
value:
errorSummary: Device check is in use and can't be deleted.
errorId: oaenwA1ra80S9W-pvbh4m6haA
errorCauses: []
ErrorEmailCustomizationCannotClearDefault:
value:
errorCode: E0000185
errorSummary: The isDefault parameter of the default email template customization
can't be set to false.
errorLink: E0000185
errorId: oaejrB1fWL1S7mc-2KcG-SOtw
errorCauses: []
ErrorEmailCustomizationCannotDeleteDefault:
value:
errorCode: E0000184
errorSummary: A default email template customization can't be deleted.
errorLink: E0000184
errorId: oaeAdRqprFuTyKokyYPbURJkA
errorCauses: []
ErrorEmailCustomizationDefaultAlreadyExists:
value:
errorCode: E0000182
errorSummary: A default email template customization already exists.
errorLink: E0000182
errorId: oaeXYwTiMvASsC3O4HCzjFaCA
errorCauses: []
ErrorEmailCustomizationLanguageAlreadyExists:
value:
errorCode: E0000183
errorSummary: An email template customization for that language already exists.
errorLink: E0000183
errorId: oaeUcGELffqRay0u1OPdnPypw
errorCauses: []
ErrorEmailDomainAlreadyExists:
value:
errorCode: E0000197
errorSummary: Email domain already exists.
errorLink: E0000197
errorId: oaeEdRqprFuTyKokyYPbURJkA
errorCauses: []
ErrorEmailDomainInUse:
value:
errorCode: E0000216
errorSummary: Email domain can't be deleted due to mail provider restrictions.
errorLink: E0000216
errorId: oaeEdRqprFuTyKokyYPbURJkB
errorCauses: []
ErrorEmailDomainInvalidStatus:
value:
errorCode: E0000217
errorSummary: Invalid status. Can't validate email domain with current status.
errorLink: E0000217
errorId: oaeEdRqprFuTyKokyYPbURJkD
errorCauses: []
ErrorEmailDomainNotVerified:
value:
errorCode: E0000218
errorSummary: Email domain couldn't be verified by mail provider.
errorLink: E0000218
errorId: oaeEdRqprFuTyKokyYPbURJkC
errorCauses: []
ErrorInternalServer:
summary: Internal Server Error
value:
errorCode: E0000009
errorSummary: Internal Server Error
errorLink: E0000000
errorId: sampleAlJ82XS2SDB_vaNIWgcA
errorCauses: []
ErrorInvalidEmailTemplateRecipients:
value:
errorCode: E0000189
errorSummary: This template does not support the recipients value.
errorLink: E0000189
errorId: oae8L1-UkcNTeGi5xVQ28_lww
errorCauses: []
ErrorInvalidLinkedObjectDef:
summary: Invalid linked objection definition
value:
errorCode: E0000127
errorSummary: Invalid linked objection definition. Linked object identifier
is already in use.
errorLink: E0000127
errorId: oaeh5FICFF2RnqakoNofPadhw
errorCauses:
- errorSummary: Linked object identifier for primary is already in use.
reason: UNIQUE_CONSTRAINT
locationType: body
domain: linkedObjects
- errorSummary: Linked object identifier for associated is already in use.
reason: UNIQUE_CONSTRAINT
locationType: body
domain: linkedObjects
ErrorInvalidTokenProvided:
summary: Invalid Token Provided
value:
errorCode: E0000011
errorSummary: Invalid token provided
errorLink: E0000011
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses: []
ErrorKeyCredentialCloneDuplicateKey:
summary: Duplicate key credential error
value:
errorCode: E0000001
errorSummary: "Api validation failed: cloneKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: Key already exists in the list of key credentials for the
target app.
ErrorKeyCredentialInvalidValidity:
summary: Key credential invalid year error
value:
errorCode: E0000001
errorSummary: "Api validation failed: generateKey"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: Validity years out of range. It should be 2 - 10 years.
ErrorMaxNumberOfSecrets:
summary: Maximum client secrets reached error
value:
errorCode: E0000001
errorSummary: "Api validation failed: OAuth2ClientSecretMediated"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: You've reached the maximum number of client secrets per client.
ErrorMissingRequiredParameter:
summary: Missing Required Parameter
value:
errorCode: E0000028
errorSummary: The request is missing a required parameter.
errorLink: E0000028
errorId: sampleiCF-l7mr9XqM1NQ
errorCauses: []
ErrorNoConnectedAgents:
value:
errorCode: E0000236
errorSummary: There are no connected agents.
errorLink: E0000236
errorId: sampleMlLvGUj_YD5v16vkYWY
errorCauses: []
ErrorPinOrCredRequestsGenerationFailure:
summary: PIN or Cred Requests Generation Failed
value:
errorCode: E0000001
errorSummary: "Api validation failed: pinRequest|credRequests"
errorLink: E0000001
errorId: oaehk3rssXQmOWDRsaFfxe8A
errorCauses:
errorSummary: There was a problem generating the pinRequest|credRequests.
ErrorPinOrCredResponsesProcessingFailure:
summary: PIN or Cred Response Processing Failed
value:
errorCode: E0000001
errorSummary: "Api validation failed: pinResponse|credResponses"
errorLink: E0000001
errorId: oaehk3rssXQmOWDRsaFfxe8B
errorCauses:
errorSummary: There was a problem generating the pinResponse|credResponses.
ErrorPublishCSRCertDoesNotMatchCSR:
summary: Mismatch certificate and CSR error
value:
errorCode: E0000001
errorSummary: "Api validation failed: certificate"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: The certificate doesn't match the CSR.
ErrorPublishCSRCertValidityLessThan90Days:
summary: Certificate valid for 90 days error
value:
errorCode: E0000001
errorSummary: "Api validation failed: certificate"
errorLink: E0000001
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses:
- errorSummary: The certificate must be valid for more than 90 days.
ErrorPushProviderUsedByCustomAppAuthenticator:
value:
errorCode: E0000187
errorSummary: Cannot delete push provider because it is being used by a custom
app authenticator.
errorLink: E0000187
errorId: oaenwA1ra80S9W-pvbh4m6haA
errorCauses: []
ErrorResourceNotFound:
summary: Resource Not Found
value:
errorCode: E0000007
errorSummary: "Not found: {0}"
errorLink: E0000007
errorId: sampleMlLvGUj_YD5v16vkYWY
errorCauses: []
ErrorTooManyRequests:
summary: Too Many Requests
value:
errorCode: E0000047
errorSummary: API call exceeded rate limit due to too many requests.
errorLink: E0000047
errorId: sampleQPivGUj_ND5v78vbYWW
errorCauses: []
ExampleOAuth2Scope:
summary: Example scope
value:
id: scp5yu8kLOnDzo7lh0g4
name: car:drive
description: Drive car
system: false
default: false
displayName: Saml Jackson
consent: REQUIRED
optional: false
metadataPublish: NO_CLIENTS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4"
hints:
allow:
- GET
- PUT
- DELETE
ExampleOAuth2Scopes:
summary: All scopes
value:
- id: scp5yu8kLOnDzo7lh0g4
name: car:drive
description: Drive car
system: false
default: false
displayName: Saml Jackson
consent: REQUIRED
optional: false
metadataPublish: NO_CLIENTS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4"
hints:
allow:
- GET
- PUT
- DELETE
ExpirePwdResponse:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: PASSWORD_EXPIRED
created: 2013-06-24T16:39:18.000Z
activated: 2013-06-24T16:39:19.000Z
statusChanged: 2013-06-24T16:39:19.000Z
lastLogin: 2013-06-24T17:39:19.000Z
lastUpdated: 2013-06-27T16:35:28.000Z
passwordChanged: 2013-06-24T16:39:19.000Z
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password: {}
recovery_question:
question: Who's a major player in the cowboy scene?
provider:
type: OKTA
name: OKTA
_links:
resetPassword:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/reset_password"
resetFactors:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/reset_factors"
expirePassword:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/expire_password"
forgotPassword:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/forgot_password"
changeRecoveryQuestion:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/change_recovery_question"
deactivate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/deactivate"
changePassword:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/credentials/change_password"
ExpirePwdWithTempPwdResponse:
value:
tempPassword: F46gy7X4
ExpiredAuthorizationServerKey:
summary: Expired Authorization Server Key
value:
status: EXPIRED
alg: RS256
e: AQAB
"n": lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7U
GLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap - CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvp
dMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu
- DYhT0hmyFc wn - tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ
kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU
kty: RSA
use: sig
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU"
hints:
allow:
- GET
FacebookIdPResponse:
summary: Facebook Identity Provider
value:
id: 0oa62b57p7c8PaGpU0h7
type: FACEBOOK
name: Facebook
status: ACTIVE
created: 2016-03-24T23:18:27.000Z
lastUpdated: 2016-03-24T23:18:27.000Z
protocol:
type: OAUTH2
endpoints:
authorization:
url: https://www.facebook.com/dialog/oauth
binding: HTTP-REDIRECT
token:
url: https://graph.facebook.com/v2.5/oauth/access_token
binding: HTTP-POST
scopes:
- public_profile
- email
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: |-
https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&
client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
scope={scopes}&redirect_uri={redirectUri}&state={state}
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
FactorEmail:
value:
id: emfnf3gSScB8xXoXK0g3
factorType: email
provider: OKTA
vendorName: OKTA
status: ACTIVE
profile:
email: [email protected]
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3/verify"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3/factors/emfnf3gSScB8xXoXK0g3"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00umvfJKwXOQ1mEL50g3"
hints:
allow:
- GET
FactorPasscodeRequest:
value:
passCode: "123456"
FactorResponseSms:
value:
id: sms2gt8gzgEBPUWBIFHN
factorType: sms
provider: OKTA
vendorName: OKTA
status: ACTIVE
created: 2014-06-27T20:27:26.000Z
lastUpdated: 2014-06-27T20:27:26.000Z
profile:
phoneNumber: +1-555-415-1337
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN/verify"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
ForgotPwdRecoveryQuestionRequest:
value:
password:
value: "uTVM,TPw55"
recovery_question:
answer: Annie Oakley
ForgotPwdRecoveryQuestionResponse:
value:
password: {}
recovery_question:
question: Who's a major player in the cowboy scene?
provider:
type: OKTA
name: OKTA
ForgotPwdResponse:
value:
resetPasswordUrl: "https://{yourOktaDomain}/signin/reset-password/XE6wE17zmphl3KqAPFxO"
GenericOidcIdpResponse:
summary: Generic OpenID Connect Identity Provider
value:
id: 0oaulob4BFVa4zQvt0g3
type: OIDC
name: Example OpenID Connect IdP
status: ACTIVE
created: 2019-02-07T20:07:47.000Z
lastUpdated: 2019-02-07T20:07:47.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://idp.example.com/authorize
binding: HTTP-REDIRECT
token:
url: https://idp.example.com/token
binding: HTTP-POST
userInfo:
url: https://idp.example.com/userinfo
binding: HTTP-REDIRECT
jwks:
url: https://idp.example.com/keys
binding: HTTP-REDIRECT
algorithms:
request:
signature:
algorithm: HS256
scope: REQUEST
scopes:
- openid
issuer:
url: https://idp.example.com
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
pkce_required: "true"
policy:
provisioning:
action: AUTO
profileMaster: false
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.email
filter: null
matchType: USERNAME
matchAttribute: null
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce}"
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
GetApplicationsByGroupResponseEx:
summary: Retrieve apps assigned to a group
value:
- id: 0oa7vicdkRNrz59R80w6
name: workday
label: hrportal2
status: ACTIVE
lastUpdated: 2021-05-17T23:10:50.000Z
created: 2021-05-17T23:10:49.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
signing:
kid: wRejFXWxFlK9nnLozx5qKWQa3fg-JRXw7dvdlTjs5Pg
settings:
app:
siteURL: https://acme.workday.com
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: null
ssoAcsUrlOverride: null
audienceOverride: null
recipientOverride: null
destinationOverride: null
attributeStatements: []
_links:
help:
href: https://testorgone-admin.okta.com/app/workday/0oa7vicdkRNrz59R80w6/setup/help/SAML_2_0/external-doc
type: text/html
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/sso/saml/metadata
type: application/xml
appLinks:
- name: login
href: https://testorgone.okta.com/home/workday/0oa7vicdkRNrz59R80w6/30
type: text/html
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/groups
logo:
- name: medium
href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6
type: image/png
users:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/lifecycle/deactivate
- id: 0oa7vicvor8YSr9Hc0w6
name: workday
label: hrportal1
status: ACTIVE
lastUpdated: 2021-05-17T23:10:22.000Z
created: 2021-05-17T23:10:22.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
signing:
kid: wRejFXWxFlK9nnLozx5qKWQa3fg-JRXw7dvdlTjs5Pg
settings:
app:
siteURL: https://acme.workday.com
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: null
ssoAcsUrlOverride: null
audienceOverride: null
recipientOverride: null
destinationOverride: null
attributeStatements: []
_links:
help:
href: https://testorgone-admin.okta.com/app/workday/0oa7vicvor8YSr9Hc0w6/setup/help/SAML_2_0/external-doc
type: text/html
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/sso/saml/metadata
type: application/xml
appLinks:
- name: login
href: https://testorgone.okta.com/home/workday/0oa7vicvor8YSr9Hc0w6/30
type: text/html
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/groups
logo:
- name: medium
href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6
type: image/png
users:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/lifecycle/deactivate
- id: 0oabkvBLDEKCNXBGYUAS
name: template_swa
label: Sample Plugin App
status: ACTIVE
lastUpdated: 2013-09-11T17:58:54.000Z
created: 2013-09-11T17:46:08.000Z
accessibility:
selfService: false
errorRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: BROWSER_PLUGIN
credentials:
scheme: EDIT_USERNAME_AND_PASSWORD
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
settings:
app:
buttonField: btn-login
passwordField: txtbox-password
usernameField: txtbox-username
url: https://example.com/login.html
_links:
logo:
- href: https:/example.okta.com/img/logos/logo_1.png
name: medium
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users"
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups"
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate"
GetApplicationsByKeyResponseEx:
summary: Retrieve apps using a key
value:
- id: 0oa1gjh63g214q0Hq0g4
name: testorgone_customsaml20app_1
label: Custom Saml 2.0 App
status: ACTIVE
lastUpdated: 2016-08-09T20:12:19.000Z
created: 2016-08-09T20:12:19.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
testorgone_customsaml20app_1_link: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${fn:substringBefore(source.login, \"@\")}"
type: BUILT_IN
signing: {}
settings:
app: {}
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: ""
ssoAcsUrl: "https://{yourOktaDomain}"
idpIssuer: "https://www.okta.com/${org.externalKey}"
audience: https://example.com/tenant/123
recipient: https://recipient.okta.com
destination: https://destination.okta.com
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
slo:
enabled: true
spIssuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
participateSlo:
enabled: true
logoutRequestUrl: https://testorgone.okta.com/logout/participate
sessionIndexRequired: true
bindingType: REDIRECT
spCertificate:
x5c:
- "MIIFnDCCA4QCCQDBSLbiON2T1zANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxDjAMBgNV\r\
\n"
requestCompressed: false
allowMultipleAcsEndpoints: false
acsEndpoints: []
attributeStatements: []
_links:
logo:
- name: medium
href: https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png
type: image/png
appLinks:
- name: testorgone_customsaml20app_1_link
href: https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4
type: text/html
help:
href: https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions
type: text/html
users:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata
type: application/xml
_embedded:
user:
id: 00ucw2RPGIUNTDQOYPOF
externalId: null
created: 2014-03-21T23:31:35.000Z
lastUpdated: 2014-03-21T23:31:35.000Z
scope: USER
status: ACTIVE
statusChanged: 2014-03-21T23:31:35.000Z
passwordChanged: null
syncState: DISABLED
lastSync: null
credentials:
userName: [email protected]
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/0oabizCHPNYALCHDUIOD"
user:
href: "https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF"
id: 0oabkvBLDEKCNXBGYUAS
name: template_swa
label: Sample Plugin App
status: ACTIVE
lastUpdated: 2013-09-11T17:58:54.000Z
created: 2013-09-11T17:46:08.000Z
accessibility:
selfService: false
errorRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: BROWSER_PLUGIN
credentials:
scheme: EDIT_USERNAME_AND_PASSWORD
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
settings:
app:
buttonField: btn-login
passwordField: txtbox-password
usernameField: txtbox-username
url: https://example.com/login.html
_links:
logo:
- href: https://example.okta.com/img/logos/logo_1.png
name: medium
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users"
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups"
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate"
_embedded:
user:
id: 00ucw2RPGIUNTDQOYPOF
externalId: null
created: 2014-06-10T15:16:01.000Z
lastUpdated: 2014-06-10T15:17:38.000Z
scope: USER
status: ACTIVE
statusChanged: 2014-06-10T15:16:01.000Z
passwordChanged: 2014-06-10T15:17:38.000Z
syncState: DISABLED
lastSync: null
credentials:
userName: [email protected]
password: {}
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS"
user:
href: "https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF"
GetApplicationsByNameResponseEx:
summary: Retrieve apps by name
value:
- id: 0oa7vicdkRNrz59R80w6
name: workday
label: hrportal2
status: ACTIVE
lastUpdated: 2021-05-17T23:10:50.000Z
created: 2021-05-17T23:10:49.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
signing:
kid: wRejFXWxFlK9nnLozx5qKWQa3fg-JRXw7dvdlTjs5Pg
settings:
app:
siteURL: https://acme.workday.com
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: null
ssoAcsUrlOverride: null
audienceOverride: null
recipientOverride: null
destinationOverride: null
attributeStatements: []
_links:
help:
href: https://testorgone-admin.okta.com/app/workday/0oa7vicdkRNrz59R80w6/setup/help/SAML_2_0/external-doc
type: text/html
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/sso/saml/metadata
type: application/xml
appLinks:
- name: login
href: https://testorgone.okta.com/home/workday/0oa7vicdkRNrz59R80w6/30
type: text/html
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/groups
logo:
- name: medium
href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6
type: image/png
users:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicdkRNrz59R80w6/lifecycle/deactivate
- id: 0oa7vicvor8YSr9Hc0w6
name: workday
label: hrportal1
status: ACTIVE
lastUpdated: 2021-05-17T23:10:22.000Z
created: 2021-05-17T23:10:22.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
signing:
kid: wRejFXWxFlK9nnLozx5qKWQa3fg-JRXw7dvdlTjs5Pg
settings:
app:
siteURL: https://acme.workday.com
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: null
ssoAcsUrlOverride: null
audienceOverride: null
recipientOverride: null
destinationOverride: null
attributeStatements: []
_links:
help:
href: https://testorgone-admin.okta.com/app/workday/0oa7vicvor8YSr9Hc0w6/setup/help/SAML_2_0/external-doc
type: text/html
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/sso/saml/metadata
type: application/xml
appLinks:
- name: login
href: https://testorgone.okta.com/home/workday/0oa7vicvor8YSr9Hc0w6/30
type: text/html
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/groups
logo:
- name: medium
href: https://tc2static.oktacdn.com/fs/bcg/4/gfs1wwhrwJR4LpB5X0w6
type: image/png
users:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa7vicvor8YSr9Hc0w6/lifecycle/deactivate
GetApplicationsByUserResponseEx:
summary: Retrieve apps assigned to a user
value:
- id: 0oa1gjh63g214q0Hq0g4
name: testorgone_customsaml20app_1
label: Custom Saml 2.0 App
status: ACTIVE
lastUpdated: 2016-08-09T20:12:19.000Z
created: 2016-08-09T20:12:19.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
testorgone_customsaml20app_1_link: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${fn:substringBefore(source.login, \"@\")}"
type: BUILT_IN
signing: {}
settings:
app: {}
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: ""
ssoAcsUrl: "https://{yourOktaDomain}"
idpIssuer: "https://www.okta.com/${org.externalKey}"
audience: https://example.com/tenant/123
recipient: https://recipient.okta.com
destination: https://destination.okta.com
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
slo:
enabled: true
spIssuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
participateSlo:
enabled: true
logoutRequestUrl: https://testorgone.okta.com/logout/participate
sessionIndexRequired: true
bindingType: REDIRECT
spCertificate:
x5c:
- "MIIFnDCCA4QCCQDBSLbiON2T1zANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxDjAMBgNV\r\
\n"
requestCompressed: false
allowMultipleAcsEndpoints: false
acsEndpoints: []
attributeStatements: []
_links:
logo:
- name: medium
href: https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png
type: image/png
appLinks:
- name: testorgone_customsaml20app_1_link
href: https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4
type: text/html
help:
href: https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions
type: text/html
users:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata
type: application/xml
_embedded:
user:
id: 00ucw2RPGIUNTDQOYPOF
externalId: null
created: 2014-03-21T23:31:35.000Z
lastUpdated: 2014-03-21T23:31:35.000Z
scope: USER
status: ACTIVE
statusChanged: 2014-03-21T23:31:35.000Z
passwordChanged: null
syncState: DISABLED
lastSync: null
credentials:
userName: [email protected]
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/0oabizCHPNYALCHDUIOD"
user:
href: "https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF"
id: 0oabkvBLDEKCNXBGYUAS
name: template_swa
label: Sample Plugin App
status: ACTIVE
lastUpdated: 2013-09-11T17:58:54.000Z
created: 2013-09-11T17:46:08.000Z
accessibility:
selfService: false
errorRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: BROWSER_PLUGIN
credentials:
scheme: EDIT_USERNAME_AND_PASSWORD
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
settings:
app:
buttonField: btn-login
passwordField: txtbox-password
usernameField: txtbox-username
url: https://example.com/login.html
_links:
logo:
- href: https://example.okta.com/img/logos/logo_1.png
name: medium
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/users"
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/groups"
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS/lifecycle/deactivate"
_embedded:
user:
id: 00ucw2RPGIUNTDQOYPOF
externalId: null
created: 2014-06-10T15:16:01.000Z
lastUpdated: 2014-06-10T15:17:38.000Z
scope: USER
status: ACTIVE
statusChanged: 2014-06-10T15:16:01.000Z
passwordChanged: 2014-06-10T15:17:38.000Z
syncState: DISABLED
lastSync: null
credentials:
userName: [email protected]
password: {}
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/0oabkvBLDEKCNXBGYUAS"
user:
href: "https://{yourOktaDomain}/api/v1/users/00ucw2RPGIUNTDQOYPOF"
GetApplicationsResponseEx:
summary: Retrieve an app
value:
id: 0oa1gjh63g214q0Hq0g4
name: testorgone_customsaml20app_1
label: Custom Saml 2.0 App
status: ACTIVE
lastUpdated: 2016-08-09T20:12:19.000Z
created: 2016-08-09T20:12:19.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
testorgone_customsaml20app_1_link: true
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${fn:substringBefore(source.login, \"@\")}"
type: BUILT_IN
signing: {}
settings:
app: {}
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
signOn:
defaultRelayState: ""
ssoAcsUrl: "https://{yourOktaDomain}"
idpIssuer: "https://www.okta.com/${org.externalKey}"
audience: https://example.com/tenant/123
recipient: https://recipient.okta.com
destination: https://destination.okta.com
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
slo:
enabled: true
spIssuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
participateSlo:
enabled: true
logoutRequestUrl: https://testorgone.okta.com/logout/participate
sessionIndexRequired: true
bindingType: REDIRECT
spCertificate:
x5c:
- "MIIFnDCCA4QCCQDBSLbiON2T1zANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxDjAMBgNV\r\
\n"
requestCompressed: false
allowMultipleAcsEndpoints: false
acsEndpoints: []
attributeStatements: []
inlineHooks:
- id: cal3ughy17pylLxQB357
_links:
self:
href: "https://{yourOktaDomain}/api/v1/inlineHooks/cal3ughy17pylLxQB357"
hints:
allow:
- GET
- PUT
- DELETE
_links:
logo:
- name: medium
href: https://testorgone.okta.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png
type: image/png
appLinks:
- name: testorgone_customsaml20app_1_link
href: https://testorgone.okta.com/home/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/aln1gofChJaerOVfY0g4
type: text/html
help:
href: https://testorgone-admin.okta.com/app/testorgone_customsaml20app_1/0oa1gjh63g214q0Hq0g4/setup/help/SAML_2_0/instructions
type: text/html
users:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/users
deactivate:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/lifecycle/deactivate
groups:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/groups
metadata:
href: https://testorgone.okta.com/api/v1/apps/0oa1gjh63g214q0Hq0g4/sso/saml/metadata
type: application/xml
GetAssociatedLinkedObjectsResponse:
summary: Retrieve all associated Linked Object values response
value:
- _links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u5zex6ztMbOZhF50h7"
- _links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u1tsf0nQKavLDUh0g5"
GetBrandResponse:
value:
id: bnd114iNkrcN6aR680g4
agreeToCustomPrivacyPolicy: false
removePoweredByOkta: false
customPrivacyPolicyUrl: null
name: Okta Default
isDefault: true
locale: en
emailDomainId: OeD114iNkrcN6aR680g4
defaultApp:
appInstanceId: 0oa114iNkrcN6aR680g4
appLinkName: null
classicApplicationUri: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4"
hints:
allow:
- GET
- PUT
- DELETE
themes:
href: "https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/themes"
hints:
allow:
- GET
emailDomain:
href: "https://{yourOktaDomain}/api/v1/email-domains/OeD114iNkrcN6aR680g4"
hints:
allow:
- GET
- PUT
GetEmailTemplateResponse:
value:
name: UserActivation
_embedded:
customizationCount: 0
settings:
recipients: ALL_USERS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings"
hints:
allow:
- GET
- PUT
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
settings:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings"
hints:
allow:
- GET
- PUT
defaultContent:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content"
hints:
allow:
- GET
customizations:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations"
hints:
allow:
- GET
- POST
- DELETE
test:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test"
hints:
allow:
- POST
GetPrimaryLinkedObjectResponse:
summary: Retrieve primary Linked Object value response
value:
- _links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7"
GetRealmAssignmentResponse:
value:
id: rul2jy7jLUlnO3ng00g4
status: ACTIVE
name: Realm Assignment 1
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: false
conditions:
profileSourceId: 0oa4enoRyjwSCy5hx0g4
expression:
value: string
actions:
assignUserToRealm:
realmId: 00g1b7rvh0xPLKXFf0g5
priority: 0
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realm-assignments/rul2jy7jLUlnO3ng00g4
method: GET
GetRoleAssignmentGovernanceGrantResources:
value:
resources:
- resource: orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g114290ar1oCC5A0g5
label: test-group-1
- resource: orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g118990hl1oCC5B0g5
label: test-group-2
_links:
next:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources?after=orn:okta:directory:00ozmkUsqWxsUxhGO0g3:groups:00g118990hl1oCC5A0g5"
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources"
GetRoleAssignmentGovernanceGrantResponse:
value:
type: ENTITLEMENT-BUNDLE
grantId: grai2556vZgWesWf10g4
bundleId: enbhz2pAwtts9UBes0g4
expirationDate: 2024-12-09 14:17:22.0
_links:
resources:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources"
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4"
GetSessionResponse:
value:
id: aps1qqonvr2SZv6o70h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: CREATED
importType: INCREMENTAL
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T16:15:44.000Z
GetThemeResponse:
value:
id: thdul904tTZ6kWVhP0g3
logo: "https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png"
favicon: "https://{yourOktaDomain}/favicon.ico"
backgroundImage: null
primaryColorHex: '#1662dd'
primaryColorContrastHex: '#000000'
secondaryColorHex: '#ebebed'
secondaryColorContrastHex: '#000000'
signInPageTouchPointVariant: OKTA_DEFAULT
endUserDashboardTouchPointVariant: OKTA_DEFAULT
errorPageTouchPointVariant: OKTA_DEFAULT
emailTemplateTouchPointVariant: OKTA_DEFAULT
loadingPageTouchPointVariant: OKTA_DEFAULT
GetUseRoleGovernanceResponse:
value:
grants:
- type: CUSTOM
grantId: grai24zWTjnDazeOI0g4
_links:
resources:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai24zWTjnDazeOI0g4/resources"
- type: ENTITLEMENT-BUNDLE
grantId: grai2556vZgWesWf10g4
bundleId: enbhz2pAwtts9UBes0g4
expirationDate: 2024-12-09 14:17:22.0
_links:
resources:
href: "https://{yourOktaDomain}//api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance/grai2556vZgWesWf10g4/resources"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5/roles/KVJUKUS7IFCE2SKO/governance"
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00u15r0i2hC4jeTne0g5\""
GetUserLinkedObjectResponse:
summary: Retrieve User Linked Object value
value:
- _links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7"
GetUserResponse:
summary: Retrieve a user type response
value:
id: otyfnly5cQjJT9PnR0g4
displayName: New User Type
name: newUserType
description: A new custom user type
createdBy: sprz9fj1ycBcsgopy1d6
lastUpdatedBy: sprz9fj1ycBcsgopy1d6
created: 2021-07-05T20:40:38.000Z
lastUpdated: 2021-07-05T20:40:38.000Z
default: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
GetYubikeyOptTokenResponse:
summary: Get Yubikey OPT Token response
value:
id: ykkxdtCA1fKVxyu6R0g3
created: 2020-06-09T23:42:05.000Z
activated: 2020-06-09T23:47:29.000Z
lastVerified: 2020-06-09T23:47:29.000Z
lastUpdated: 2020-06-09T23:47:29.000Z
status: ACTIVE
profile:
serial: "000009508427"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkxdtCA1fKVxyu6R0g3"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3"
hints:
allow:
- GET
deactivate:
href: "https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3/factors/ykfxduQAhl89YyPrV0g3"
hints:
allow:
- DELETE
GoogleIdPResponse:
summary: Google Identity Provider
value:
id: 0oa62bfdiumsUndnZ0h7
type: GOOGLE
name: Google
status: ACTIVE
created: 2016-03-24T23:21:49.000Z
lastUpdated: 2016-03-24T23:21:49.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://accounts.google.com/o/oauth2/auth
binding: HTTP-REDIRECT
token:
url: https://www.googleapis.com/oauth2/v3/token
binding: HTTP-POST
scopes:
- profile
- email
- openid
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: |-
https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&
client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
scope={scopes}&redirect_uri={redirectUri}&state={state}
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
GovernanceBundle:
summary: Governance Bundle
value:
id: 0bbfxqCAJWWGELFTYAAA
name: Group admin bundle
description: Group bundle for administrative access
status: ACTIVE
orn: orn:okta:governance:00o5rb5mt2H3d1TJd0h7:bundles:0bbfxqCAJWWGELFTYAAA
_links:
self: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA
entitlements: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements
GovernanceBundleCreateRequestCustomRole:
summary: Create governance bundle with custom role
value:
name: Custom admin bundle
description: Custom bundle for administrative access
entitlements:
role: cr0WxyzJxGIr0ouum0g4
resourceSets:
- iamoJDFKaJxGIr0oamd9g
GovernanceBundleCreateRequestScopedStandardRole:
summary: Create governance bundle with scoped standard role
value:
name: Group admin bundle
description: Group bundle for administrative access
entitlements:
role: GROUP_MEMBERSHIP_ADMIN
targets:
- 00guaxWZ0AOa5NFAj0g3
GovernanceBundleCreateRequestStandardRole:
summary: Create governance bundle with non-scoped standard role
value:
name: Group admin bundle
description: Group bundle for administrative access
entitlements:
role: GROUP_MEMBERSHIP_ADMIN
GovernanceBundleUpdateRequestCustomRole:
summary: Update governance bundle with custom role
value:
name: Custom admin bundle
description: Custom bundle for administrative access
entitlements:
role: cr0WxyzJxGIr0ouum0g4
resourceSets:
- iamoJDFKaJxGIr0oamd9g
GovernanceBundleUpdateRequestScopedStandardRole:
summary: Update governance bundle with scoped standard role
value:
name: Group admin bundle
description: Group bundle for administrative access
entitlements:
role: GROUP_MEMBERSHIP_ADMIN
targets:
- 00guaxWZ0AOa5NFAj0g3
GovernanceBundleUpdateRequestStandardRole:
summary: Update governance bundle with non-scoped standard role
value:
name: Group admin bundle
description: Group bundle for administrative access
entitlements:
role: GROUP_MEMBERSHIP_ADMIN
GovernanceBundlesResponse:
summary: List of governance bundles
value:
bundles:
- id: 0bbfxqCAJWWGELFTYAAA
name: Group admin bundle
description: Group bundle for administrative access
status: ACTIVE
orn: orn:okta:governance:00o5rb5mt2H3d1TJd0h7:bundles:0bbfxqCAJWWGELFTYAAA
_links:
entitlements: http://your-subdomain.okta.com/api/v1/iam/governance/bundles/0bbfxqCAJWWGELFTYAAA/entitlements
_links:
self:
href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?limit=2&after=10
next:
href: http://your-subdomain.okta.com/api/v1/iam/governance/bundles?after=bundleId12
GroupAssignmentExListResponse:
summary: Application Groups list with embedded metadata
value:
- id: 00g15acRUy0SYb9GT0g4
priority: 0
lastUpdated: 2024-06-02T13:17:57.000Z
profile:
preferredLanguage: English
manager: Donald Glover
securityQuestion: Who is the footballer to have played the game
securityAnswer: Ronaldinho
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: wazobia
userType: null
department: marketing
_links:
app:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4"
self:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4"
group:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4"
_embedded:
metadata:
credentials: {}
profile:
division:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
preferredLanguage:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
manager:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
securityQuestion:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
securityAnswer:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
timezone:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
organization:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
initialStatus:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
managerId:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
userType:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
locale:
source:
type: USER
value:
- id: 00uzojLwDGgUynjJS0g3
self:
href: "http://{yourOktaDomain}/api/v1/users/00uzojLwDGgUynjJS0g3"
lastUpdated: null
department:
source:
type: MAPPING
value:
- id: null
lastUpdated: null
GroupAssignmentExResponse:
summary: Application Group response
value:
id: 00g15acRUy0SYb9GT0g4
priority: 0
lastUpdated: 2024-06-02T13:17:57.000Z
profile:
preferredLanguage: English
manager: Donald Glover
securityQuestion: Who is the footballer to have played the game
securityAnswer: Ronaldinho
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: wazobia
userType: null
department: marketing
_links:
app:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4"
self:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4"
group:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4"
GroupAssignmentPatchRequestExample:
summary: Update app group request
value:
- op: replace
path: /profile/manager
value: Carlo Ancelotti
GroupAssignmentPatchResponseExample:
summary: Update Application Group response
value:
id: 00g15acRUy0SYb9GT0g4
priority: 0
lastUpdated: 2024-06-03T13:42:20.000Z
profile:
preferredLanguage: English
securityQuestion: Who is the footballer to have played the game
securityAnswer: Jay Jay Okocha
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: null
userType: null
department: Accounting
manager: Carlo Ancelotti
_links:
app:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4"
self:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4"
group:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4"
GroupAssignmentPutRequestExample:
summary: Assign Application Group request
value:
id: 00g15acRUy0SYb9GT0g4
profile:
preferredLanguage: English
manager: Arsene Wenger
securityQuestion: Who is the footballer to have played the game
securityAnswer: Jay Jay Okocha
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: null
userType: null
department: Accounting
GroupAssignmentPutResponseExample:
summary: Assign Application Group response
value:
id: 00g15acRUy0SYb9GT0g4
priority: 0
lastUpdated: 2024-06-03T13:52:07.000Z
profile:
preferredLanguage: English
manager: Arsene Wenger
securityQuestion: Who is the footballer to have played the game
securityAnswer: Jay Jay Okocha
timezone: Canada/Eastern
initialStatus: active_with_pass
managerId: [email protected]
locale: en_US
division: top
organization: null
userType: null
department: Accounting
_links:
app:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4"
self:
href: "http://{yourOktaDomain}/api/v1/apps/0oa15anjcUHSI6hTB0g4/groups/00g15acRUy0SYb9GT0g4"
group:
href: "http://{yourOktaDomain}/api/v1/groups/00g15acRUy0SYb9GT0g4"
GroupSchemaAddRequest:
value:
definitions:
custom:
id: '#custom'
type: object
properties:
groupContact:
title: Group administrative contact
description: Group administrative contact
type: string
required: false
minLength: 1
maxLength: 20
permissions:
- principal: SELF
action: READ_WRITE
required: []
GroupSchemaResponse:
value:
$schema: http://json-schema.org/draft-04/schema#
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/group/default"
method: GET
rel: self
created: 2021-01-30T00:18:24.000Z
definitions:
base:
id: '#base'
properties: {}
required:
- name
type: object
custom:
id: '#custom'
properties:
groupContact:
description: Group administrative contact
master:
type: PROFILE_MASTER
mutability: READ_WRITE
permissions:
- action: READ_WRITE
principal: SELF
scope: NONE
title: Group administrative contact
type: string
required: []
type: object
description: Okta group profile template
id: "https://{yourOktaDomain}/meta/schemas/group/default"
lastUpdated: 2021-02-25T23:05:31.000Z
name: group
properties:
profile:
allOf:
- $ref: '#/definitions/custom'
- $ref: '#/definitions/base'
title: Okta group
type: object
IAMStandardRoleResponseClient:
value:
id: irb4jlodtdN4yJ88b0g7
role: ACCESS_REQUESTS_ADMIN
label: Access Requests Administrator
type: ACCESS_REQUESTS_ADMIN
status: ACTIVE
created: 2023-07-06T21:52:48.000Z
lastUpdated: 2023-07-06T21:52:48.000Z
assignmentType: CLIENT
resource-set: ACCESS_CERTIFICATIONS_IAM_POLICY
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/client/0oa5vymVNCe2cPEeZ0g4"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN/permissions"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_REQUESTS_ADMIN/members/irb4jlomnnDBuBDyJ0g7"
IAMStandardRoleResponseUser:
value:
id: irb1q92TFAHzySt3x0g4
role: ACCESS_REQUESTS_ADMIN
label: Access Requests Administrator
type: ACCESS_REQUESTS_ADMIN
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: USER
resource-set: ACCESS_CERTIFICATIONS_IAM_POLICY
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_REQUESTS_ADMIN/permissions"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_REQUESTS_ADMIN/members/irb1q92TFAHzySt3x0g4"
IAMStandardRolesListResponse:
value:
- id: IFIFAX2BIRGUSTQ
label: Application Administrator
type: APP_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: irb1q92TFAHzySt3x0g4
role: cr0Yq6IJxGIr0ouum0g3
label: UserCreatorRole
type: CUSTOM
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: USER
resource-set: iamoJDFKaJxGIr0oamd9g
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00u1gytb3XCr9Dkr18r2"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions"
- id: irb5e92YgBazyyQ3x1q5
role: ACCESS_CERTIFICATIONS_ADMIN
label: Access Certifications Administrator
type: ACCESS_CERTIFICATIONS_ADMIN
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: USER
resource-set: ACCESS_CERTIFICATIONS_IAM_POLICY
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00u1gytb3XCr9Dkr18r2"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissions"
IAMStandardRolesListResponseClient:
value:
- id: irb5e92YgBazyyQ3x1q5
role: ACCESS_CERTIFICATIONS_ADMIN
label: Access Certifications Administrator
type: ACCESS_CERTIFICATIONS_ADMIN
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: CLIENT
resource-set: ACCESS_CERTIFICATIONS_IAM_POLICY
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/clients/0oa4ee9vgbIuqTUvd0g7"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissionsZ"
IAMStandardRolesListResponseGroup:
value:
- id: irb5e92YgBazyyQ3x1q5
role: ACCESS_CERTIFICATIONS_ADMIN
label: Access Certifications Administrator
type: ACCESS_CERTIFICATIONS_ADMIN
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: Group
resource-set: ACCESS_CERTIFICATIONS_IAM_POLICY
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/ACCESS_CERTIFICATIONS_IAM_POLICY/bindings/ACCESS_CERTIFICATIONS_ADMIN/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/ACCESS_CERTIFICATIONS_ADMIN"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/permission-sets/OKTA_IAM_TEST_DELIVERED_ROLE/permissions"
IdPAppUserResponse:
summary: IdP User
value:
id: 00u5t60iloOHN9pBi0h7
externalId: externalId
created: 2017-12-19T17:30:16.000Z
lastUpdated: 2017-12-19T17:30:16.000Z
profile:
profileUrl: null
firstName: null
lastName: null
honorificSuffix: null
displayName: null
honorificPrefix: null
middleName: null
email: null
_links:
idp:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bfdiumsUndnZ0h7"
self:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bfdiumsUndnZ0h7/users/00u5t60iloOHN9pBi0h7"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7"
IdPKeyCredentialRequest:
summary: Identity Provider Key Credential
value:
e: "65537"
"n": "101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747"
x5c:
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE
IdPKeyCredentialResponse:
summary: Identity Provider Key Credential
value:
kid: your-key-id
created: 2016-01-03T18:15:47.000Z
lastUpdated: 2016-01-03T18:15:47.000Z
e: "65537"
"n": "101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747"
kty: RSA
use: sig
x5c:
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE
IdPSigningKeyCredentialResponse:
summary: Identity Provider Signing Key Credential
value:
created: 2015-12-10T18:56:23.000Z
expiresAt: 2017-12-10T18:56:22.000Z
kid: akm5hvbbevE341ovl0h7
kty: RSA
use: sig
x5c:
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE
InlineHookTelephony:
value:
channel:
type: HTTP
version: 1.0.0
config:
uri: https://your-external-webservice/sendOtp
headers: []
method: POST
authScheme:
type: HEADER
key: x-telephony-key
created: 2024-03-28T17:30:25.000Z
id: caldpyulr3nbET2du1d7
lastUpdated: 2024-05-07T16:35:18.000Z
name: testTelephonyHook
status: ACTIVE
type: com.okta.telephony.provider
version: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/inlineHooks/caldpyulr3nbET2du1d7"
execute:
href: "https://{yourOktaDomain}/api/v1/inlineHooks/caldpyulr3nbET2du1d7/execute"
hints:
allow":
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/inlineHooks/caldpyulr3nbET2du1d7/lifecycle/deactivate"
hints:
allow":
- POST
InvalidRotateUse:
summary: Invalid Use
value:
errorCode: E0000001
errorSummary: "Api validation failed: rotateKeys"
errorLink: E0000001
errorId: oaeprak9qKHRlaWiclJ4oPJRQ
errorCauses:
- errorSummary: Invalid value specified for key 'use' parameter
KeyCredentialExample:
summary: Key Credential example
value:
created: 2015-12-10T18:56:23.000Z
lastUpdated: 2024-08-13T18:26:57.000Z
expiresAt: 2017-12-10T18:56:22.000Z
x5c:
- MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw==
e: AQAB
"n": mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ
kid: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4
kty: RSA
use: sig
x5t#S256": 5GOpy9CQVtfvBmu2T8BHvpKE4OGtC3BuS046t7p9pps
LinkIdPAppUserResponse:
summary: Linked IdP User
value:
id: 00ub0oNGTSWTBKOLGLNR
externalId: "121749775026145"
created: 2017-03-30T02:19:51.000Z
lastUpdated: 2017-03-30T02:19:51.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62b57p7c8PaGpU0h7/users/00ub0oNGTSWTBKOLGLNR"
hints:
allow:
- GET
- DELETE
idp:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62b57p7c8PaGpU0h7"
user:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
ListAllKeyCredentialsExample:
summary: List all Key Credentials example
value:
- created: 2015-12-10T18:56:23.000Z
lastUpdated: 2024-08-13T18:26:57.000Z
expiresAt: 2017-12-10T18:56:22.000Z
x5c:
- MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw==
e: AQAB
"n": mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ
kid: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4
kty: RSA
use: sig
x5t#S256": 5GOpy9CQVtfvBmu2T8BHvpKE4OGtC3BuS046t7p9pps
- created: 2015-12-10T18:55:35.000Z
lastUpdated: 2024-08-13T18:26:57.000Z
expiresAt: 2045-01-23T02:15:23.000Z
x5c:
- MIIDqDCCApCgAwIBAgIGAUsUkouzMA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTAxMjMwMjE0MjNaFw00NTAxMjMwMjE1MjNaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKhmkmKsu3FYeBiJg44aN6Ah3g9gof1cytXJVMnblDUWpLfe/FMUQCssh8Y8NCYRri5jni4efBgk6B3SkC7ymqsOXILIEHSwUYWnAaqDOTxO101mHzryowu1+0PldRNoyTthahpprvAPYlTin9zrDTqFT+WY/zwoaN8H+CfixlW1nM85qF18zYYekkW50MSoHPcfJKe2ywIhPXTYTSBEPcHh8dQEjBrZn7A4qOoDnfOXll8OL7j2O6EVyTtHA0tLJHVLpwI4gSPsXFwEnHltjN57odwYe9yds0BbM/YG9i+am1+3cmZ6Uyd16mLGclrr05o9BHcEZ4ZctV2hr6whbRsCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEAnNlF27gRmhGTQ+GRAvbvYToFRgsIbBAPvRqB2LmEIiQ6UJd602w6uP1sv/zEzBYg4SnMLuVyWgOJ6d71dCvXdIO9mgAq6BaEPjlo0WhGyt+zGrpkMnIX5EwRa64kHydcPRHNA607wVYA96sJdyNJEMzBvjY9fJnfevzzDCN3NWpMS2T6rk6HP5IziI1VuFWY2OUC1kbCqLj1dUgp8koe3ftLL55ZpkAocnVMnrzBveNjgAOAiKTMcyS0bhESph9aVWvuHVZSfTnUjnTPb/4jA2YlB3ED+qaU3aqHwft1KXwZskNXBKXy7lyC+CMoeB3/ncFhSg/UllBooPPS3wYlNA==
e: AQAB
"n": htbi5H5MN_oYaKcZ8vlWRZn2oTrPY0v8_2Br_VZPJgJ57dCgguq5dDk1Me_ax-B3kjBPdXcW8wEoUFaU30spyVeQjZrdqsSvF0nMW4OzrMOIqrGLwCrAoDBS8tutfk5Y7qc-5xABzxgu4BjgSK5nWXbCt_UR0DzVTknotmMGeT8tAej8F6GAphLa0YhIxWT7Jy-y_pdANsiUPRiZBoLueGI0rrCqgYHIQVjNoj4-si105KCXbQuyYM9_Cd-dyyu5KJ4Ic0cOW61gpx4pnecMgSy8OX57FEd06W2hExBd49ah6jra2KFMeOGe3rkIXirdkofl1mBgeQ77ruKO1wW9Qw
kid: mXtzOtml09Dg1ZCeKxTRBo3KrQuBWFkJ5oxhVagjTzo
kty: RSA
use: sig
x5t#S256": 7CCyXWwKzH4P6PoBP91B1S_iIZVzuGffVnUXu-BTYQQ
ListAllKeysResponse:
summary: List All Keys response example
value:
- id: HKY1i2htmXF5UNQhL0g4
keyId: bb5bed7d-6e4d-488f-9c86-59b93a2bb3fb
name: My new key
created: 2022-08-22T16:34:33.000Z
lastUpdated: 2022-08-22T16:34:33.000Z
isUsed: "true"
- id: HKY1p7jWLndGQV9M60g4
keyId: 7fbc27fd-e3df-4522-86bf-1930110256ad
name: Test key
created: 2022-08-31T18:09:58.000Z
lastUpdated: 2022-08-31T18:09:58.000Z
isUsed: "false"
ListAppGrantsEx:
summary: List all app Grants example
value:
- id: oag91n9ruw3dsaXzP0h6
status: ACTIVE
created: 2023-02-21T16:54:00.000Z
createdBy:
id: 00u6eltha0nrSc47i0h7
type: User
lastUpdated: 2023-02-21T16:54:00.000Z
issuer: "{yourOktaDomain}"
clientId: "{clientId}"
scopeId: okta.users.read
source: ADMIN
_embedded:
scope:
id: okta.users.read
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}"
title: Application name
self:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oag91n9ruw3dsaXzP0h6"
hints:
allow:
- GET
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}"
title: Client name
- id: oaghm3sh9ukdkvDmO0h6
status: ACTIVE
created: 2023-02-03T21:57:49.000Z
createdBy:
id: 00u6eltha0nrSc47i0h7
type: User
lastUpdated: 2023-02-03T21:57:49.000Z
issuer: "{yourOktaDomain}"
clientId: "{clientId}"
scopeId: okta.apps.manage
source: ADMIN
_embedded:
scope:
id: okta.apps.manage
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}"
title: Application name
self:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}/grants/oaghm3sh9ukdkvDmO0h6"
hints:
allow:
- GET
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}"
title: Client name
ListAppLinks:
value:
- id: 00ub0oNGTSWTBKOLGLNR
label: Google Apps Mail
linkUrl: "https://{yourOktaDomain}/home/google/0oa3omz2i9XRNSRIHBZO/50"
logoUrl: "https://{yourOktaDomain}/img/logos/google-mail.png"
appName: google
appInstanceId: 0oa3omz2i9XRNSRIHBZO
appAssignmentId: 0ua3omz7weMMMQJERBKY
credentialsSetup: false
hidden: false
sortOrder: 0
- id: 00ub0oNGTSWTBKOLGLNR
label: Google Apps Calendar
linkUrl: "https://{yourOktaDomain}/home/google/0oa3omz2i9XRNSRIHBZO/54"
logoUrl: "https://{yourOktaDomain}/img/logos/google-calendar.png"
appName: google
appInstanceId: 0oa3omz2i9XRNSRIHBZO
appAssignmentId: 0ua3omz7weMMMQJERBKY
credentialsSetup: false
hidden: false
sortOrder: 1
- id: 00ub0oNGTSWTBKOLGLNR
label: Box
linkUrl: "https://{yourOktaDomain}/home/boxnet/0oa3ompioiQCSTOYXVBK/72"
logoUrl: "https://{yourOktaDomain}/img/logos/box.png"
appName: boxnet
appInstanceId: 0oa3ompioiQCSTOYXVBK
appAssignmentId: 0ua3omx46lYEZLPPRWBO
credentialsSetup: false
hidden: false
sortOrder: 3
- id: 00ub0oNGTSWTBKOLGLNR
label: Salesforce.com
linkUrl: "https://{yourOktaDomain}/home/salesforce/0oa12ecnxtBQMKOXJSMF/46"
logoUrl: "https://{yourOktaDomain}/img/logos/salesforce_logo.png"
appName: salesforce
appInstanceId: 0oa12ecnxtBQMKOXJSMF
appAssignmentId: 0ua173qgj5VAVOBQMCVB
credentialsSetup: true
hidden: false
sortOrder: 2
ListAssocAuthServerResponse:
summary: List associated Authorization Servers
value:
- id: "{authorizationServerId}"
name: Sample Authorization Server
description: Sample Authorization Server description
audiences:
- https://api.resource.com
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
issuerMode: CUSTOM_URL
status: ACTIVE
created: 2023-05-17T22:25:57.000Z
lastUpdated: 2023-05-17T22:25:57.000Z
credentials:
signing:
rotationMode: DYNAMIC
lastRotated: 2023-05-17T22:25:57.000Z
nextRotation: 2023-08-15T22:25:57.000Z
kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4
use: sig
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}"
hints:
allow:
- DELETE
ListAuthServersResponse:
summary: List all custom authorization servers in your org
value:
- id: "{authorizationServerId}"
name: Sample Authorization Server
description: Sample Authorization Server description
audiences:
- https://api.resource.com
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
issuerMode: ORG_URL
status: ACTIVE
created: 2023-05-17T22:25:57.000Z
lastUpdated: 2023-05-17T22:25:57.000Z
credentials:
signing:
rotationMode: AUTO
lastRotated: 2023-05-17T22:25:57.000Z
nextRotation: 2023-08-15T22:25:57.000Z
kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4
_links:
scopes:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes"
hints:
allow:
- GET
claims:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims"
hints:
allow:
- GET
policies:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies"
hints:
allow:
- GET
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}"
hints:
allow:
- GET
- DELETE
- PUT
metadata:
- name: oauth-authorization-server
href: "https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server"
hints:
allow:
- GET
- name: openid-configuration
href: "https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration"
hints:
allow:
- GET
rotateKey:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate"
hints:
allow:
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate"
hints:
allow:
- POST
ListAuthorizationServerKeys:
summary: All Credential Keys
value:
- status: ACTIVE
alg: RS256
e: AQAB
"n": "g0MirhrysJMPm_wK45jvMbbyanfhl-jmTBv0o69GeifPaISaXGv8LKn3-CyJvUJcjjeHE17KtumJWVxUDRzFqtIMZ1ctCZyIAuWO0n\
\ LKilg7_EIDXJrS8k14biqkPO1lXGFwtjo3zLHeFSLw6sWf-CEN9zv6Ff3IAXb-RMYpfh-bVrxIgWsWCxjLW-UKI3la-gs0nWHH2PJr5HLJuI\
\ JIOL5HLJuIJIOLWahqTnm_r1LSCSYr6N4C-fh--w2_BW8DzTHalBYe76bNr0d7AqtR4tGazmrvrc79Wa2bjyxmhhN1u9jSaZQqq-3VZEod8q3,\
\ WHH2PJ5v1LoXniJQ4a2W8nDVqb6h4E8MUKYOpljTfQ"
kid: RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc
kty: RSA
use: sig
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/RQ8DuhdxCczyMvy7GNJb4Ka3lQ99vrSo3oFBUiZjzzc"
hints:
allow:
- GET
- status: NEXT
alg: RS256
e: AQAB
"n": l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK
3 HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37
- XDIDb0XG - R8DOoOHLJPTpsgH - rJe M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX
- 0 TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB
- GeDiUZiBYQdPR - myB4ZoQ
kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo
kty: RSA
use: sig
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo"
hints:
allow:
- GET
- status: EXPIRED
alg: RS256
e: AQAB
"n": lC4ehVB6W0OCtNPnz8udYH9Ao83B6EKnHA5eTcMOap_lQZ-nKtS1lZwBj4wXRVc1XmS0d2OQFA1VMQ-dHLDE3CiGfsGqWbaiZFdW7U
GLO1nAwfDdH6xp3xwpKOMewDXbAHJlXdYYAe2ap - CE9c5WLTUBU6JROuWcorHCNJisj1aExyiY5t3JQQVGpBz2oUIHo7NRzQoKimvp
dMvMzcYnTlk1dhlG11b1GTkBclprm1BmOP7Ltjd7aEumOJWS67nKcAZzl48Zyg5KtV11V9F9dkGt25qHauqFKL7w3wu
- DYhT0hmyFc wn - tXS6e6HQbfHhR_MQxysLtDGOk2ViWv8AQ
kid: h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU
kty: RSA
use: sig
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/h5Sr3LXcpQiQlAUVPdhrdLFoIvkhRTAVs_h39bQnxlU"
hints:
allow:
- GET
ListAuthorizationServerPolicies:
summary: List Authorization Server Policies
value:
- type: OAUTH_AUTHORIZATION_POLICY
id: 00palyaappA22DPkj0h7
status: ACTIVE
name: Vendor2 Policy
description: Vendor2 policy description
priority: 1
system: false
conditions:
clients:
include:
- ALL_CLIENTS
created: 2017-05-26T19:43:53.000Z
lastUpdated: 2017-06-07T15:28:17.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/lifecycle/deactivate"
hints:
allow:
- POST
rules:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies/00palyaappA22DPkj0h7/rules"
hints:
allow:
- GET
ListAuthorizationServerPolicyRules:
summary: List Authorization Server Policy Rules
value:
- type: RESOURCE_ACCESS
id: 0prbsjfyl01zfSZ9K0h7
status: ACTIVE
name: Default Policy Rule
priority: 1
created: 2017-08-25T16:57:02.000Z
lastUpdated: 2017-08-30T14:51:05.000Z
system: false
conditions:
people:
users:
include: []
exclude: []
groups:
include:
- EVERYONE
exclude: []
grantTypes:
include:
- implicit
- client_credentials
- authorization_code
- password
scopes:
include:
- '*'
actions:
token:
accessTokenLifetimeMinutes: 60
refreshTokenLifetimeMinutes: 0
refreshTokenWindowMinutes: 10080
inlineHook:
id: cal4egvp1mbMldrYN0g7
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authServerId}/policies/{policyId}/rules/0prbsjfyl01zfSZ9K0h7/lifecycle/deactivate"
hints:
allow:
- POST
ListBrandsResponse:
value:
- id: bnd114iNkrcN6aR680g4
name: Okta Default
isDefault: true
agreeToCustomPrivacyPolicy: false
removePoweredByOkta: false
customPrivacyPolicyUrl: null
locale: en
emailDomainId: OeD114iNkrcN6aR680g4
defaultApp:
appInstanceId: 0oa114iNkrcN6aR680g4
appLinkName: null
classicApplicationUri: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4"
hints:
allow:
- GET
- PUT
- DELETE
themes:
href: "https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/themes"
hints:
allow:
- GET
emailDomain:
href: "https://{yourOktaDomain}/api/v1/email-domains/OeD114iNkrcN6aR680g4"
hints:
allow:
- GET
- PUT
ListClientsResponse:
summary: List all Client resources for which an authorization server has tokens
value:
- client_id: "{clientId}"
client_name: My Web App
client_uri: "null,"
logo_uri: "null,"
_links:
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}"
title: My Web App
tokens:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens"
hints:
allow:
- GET
- DELETE
ListCustomTokenClaimsResponse:
summary: List all custom token Claims for an authorization server
value:
- id: "{claimId}"
name: sub
status: ACTIVE
claimType: RESOURCE
valueType: EXPRESSION
value: "(appuser != null) ? appuser.userName : app.clientId"
conditions:
scopes:
- profile
system: true
alwaysIncludeInToken: true
apiResourceId: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId}"
hints:
allow:
- GET
- PUT
- DELETE
ListEmailCustomizationResponse:
value:
- language: en
isDefault: true
subject: "Welcome to ${org.name}!"
body: "
Hello, ${user.profile.firstName}. Click\
\ here to activate your account."
id: oel11u6DqUiMbQkpl0g4
created: 2021-11-09T20:38:10.000Z
lastUpdated: 2021-11-11T20:38:10.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4"
hints:
allow:
- GET
- PUT
- DELETE
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
preview:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel11u6DqUiMbQkpl0g4/preview"
hints:
allow:
- GET
test:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test"
hints:
allow:
- POST
ListEmailTemplateResponse:
value:
- name: UserActivation
_embedded:
customizationCount: 0
settings:
recipients: ALL_USERS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings"
hints:
allow:
- GET
- PUT
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
settings:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/settings"
hints:
allow:
- GET
- PUT
defaultContent:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content"
hints:
allow:
- GET
customizations:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations"
hints:
allow:
- GET
- POST
- DELETE
test:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test"
hints:
allow:
- POST
ListFactorsResults:
summary: All of the enrolled Factors for the specified User
value:
- id: ufs2bysphxKODSZKWVCT
factorType: question
provider: OKTA
vendorName: OKTA
status: ACTIVE
created: 2014-04-15T18:10:06.000Z
lastUpdated: 2014-04-15T18:10:06.000Z
profile:
question: favorite_art_piece
questionText: What is your favorite piece of art?
_links:
questions:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions"
hints:
allow:
- GET
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ufs2bysphxKODSZKWVCT"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
- id: ostf2gsyictRQDSGTDZE
factorType: token:software:totp
provider: OKTA
status: PENDING_ACTIVATION
created: 2014-06-27T20:27:33.000Z
lastUpdated: 2014-06-27T20:27:33.000Z
profile:
credentialId: [email protected]
_links:
next:
name: activate
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf2gsyictRQDSGTDZE/lifecycle/activate"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/ostf2gsyictRQDSGTDZE"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
_embedded:
activation:
timeStep: 30
sharedSecret: HE64TMLL2IUZW2ZLB
encoding: base32
keyLength: 16
- id: sms2gt8gzgEBPUWBIFHN
factorType: sms
provider: OKTA
status: ACTIVE
created: 2014-06-27T20:27:26.000Z
lastUpdated: 2014-06-27T20:27:26.000Z
profile:
phoneNumber: +1-555-415-1337
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN/verify"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/sms2gt8gzgEBPUWBIFHN"
hints:
allow:
- GET
- DELETE
user:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL"
hints:
allow:
- GET
ListFeatureDependenciesResponse:
summary: List all dependencies for a feature
value:
- id: ftrZooGoT8b41iWRiQs7
description: Example feature description
name: Example feature name
stage:
state: OPEN
value: EA
status: ENABLED
type: self-service
_links:
self:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/features/ftrZooGoT8b41iWRiQs7"
dependents:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependents"
dependencies:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependencies"
ListFeatureDependentsResponse:
summary: List all feature dependents for the specified feature
value:
- id: ftrZooGoT8b41iWRiQs7
description: Example feature description
name: Example feature name
stage:
state: OPEN
value: EA
status: ENABLED
type: self-service
_links:
self:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/features/ftrZooGoT8b41iWRiQs7"
dependents:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependents"
dependencies:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependencies"
ListFeaturesResponse:
summary: List all self-service features for your org
value:
- id: ftrZooGoT8b41iWRiQs7
description: Example feature description
name: Example feature name
stage:
state: CLOSED
value: BETA
status: DISABLED
type: self-service
_links:
self:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/features/ftrZooGoT8b41iWRiQs7"
dependents:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependents"
dependencies:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependencies"
ListIdPUsersResponse:
summary: List of linked IdP Users
value:
- id: 00u5cl9lo7nMjHjPr0h7
externalId: "109912936038778"
created: 2015-11-03T19:10:11.000Z
lastUpdated: 2015-11-03T19:11:49.000Z
profile:
firstName: Carol
middleName: Lee
lastName: Johnson
email: [email protected]
displayName: Carol Johnson
profile: https://www.facebook.com/app_scoped_user_id/109912936038778/
_links:
self:
href: "https://{yourOktaDomain}/api/v1/idps/0oa4lb6lbtmH355Hx0h7/users/00u5cl9lo7nMjHjPr0h7"
hints:
allow:
- GET
- DELETE
idp:
href: "https://{yourOktaDomain}/api/v1/idps/0oa4lb6lbtmH355Hx0h7"
user:
href: "https://{yourOktaDomain}/api/v1/users/00u5cl9lo7nMjHjPr0h7"
ListLinkedObjects:
summary: List all Linked Object definitions
value:
- primary:
name: manager
title: manager
description: Manager link property
type: USER
associated:
name: subordinate
title: subordinate
description: Subordinate link property
type: USER
_links:
self:
href: http://your-subdomain.okta.com/api/v1/meta/schemas/user/linkedObjects/manager
ListLogs:
summary: List all system logs
value:
- actor:
id: 00uttidj01jqL21aM1d6
type: User
alternateId: [email protected]
displayName: John Doe
detailEntry: null
client:
userAgent:
rawUserAgent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36\
\ (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
os: Mac OS X
browser: CHROME
zone: null
device: Computer
id: null
ipAddress: 10.0.0.1
geographicalContext:
city: New York
state: New York
country: United States
postalCode: 10013
geolocation:
lat: 40.3157
lon: -74.01
device:
id: guofdhyjex1feOgbN1d9
name: "Mac15,6"
os_platform: OSX
os_version: 14.6.0
managed: false
registered: true
device_integrator: null
disk_encryption_type: ALL_INTERNAL_VOLUMES
screen_lock_type: BIOMETRIC
jailbreak: null
secure_hardware_present: true
authenticationContext:
authenticationProvider: null
credentialProvider: null
credentialType: null
issuer: null
interface: null
authenticationStep: 0
rootSessionId: idxBager62CSveUkTxvgRtonA
externalSessionId: idxBager62CSveUkTxvgRtonA
displayMessage: User login to Okta
eventType: user.session.start
outcome:
result: SUCCESS
reason: null
published: 2024-08-13T15:58:20.353Z
securityContext:
asNumber: 394089
asOrg: ASN 0000
isp: google
domain: null
isProxy: false
severity: INFO
debugContext:
debugData:
requestId: ab609228fe84ce59cdcbfa690bcce016
requestUri: /idp/idx/authenticators/poll
url: /idp/idx/authenticators/poll
legacyEventType: core.user_auth.login_success
transaction:
type: WEB
id: ab609228fe84ce59cdcbfa690bgce016
detail: null
uuid: dc9fd3c0-598c-11ef-8478-2b7584bf8d5a
version: 0
request:
ipChain:
- ip: 10.0.0.1
geographicalContext:
city: New York
state: New York
country: United States
postalCode: 10013
geolocation:
lat: 40.3157
lon: -74.01
version: V4
source: null
target:
- id: pfdfdhyjf0HMbkP2e1d7
type: AuthenticatorEnrollment
alternateId: unknown
displayName: Okta Verify
detailEntry: null
- id: 0oatxlef9sQvvqInq5d6
type: AppInstance
alternateId: Okta Admin Console
displayName: Okta Admin Console
detailEntry: null
ListMappingsResponse:
summary: List all Profile Mappings response
value:
- id: prm1k47ghydIQOTBW0g4
source:
id: otysbePhQ3yqt4cVv0g3
name: user
type: user
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/types/user/otysbePhQ3yqt4cVv0g3"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscsbePhQ3yqt4cVv0g3"
target:
id: 0oa1qmn4LZQQEH0wZ0g4
name: okta_org2org
type: appuser
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1qmn4LZQQEH0wZ0g4"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/apps/0oa1qmn4LZQQEH0wZ0g4/default"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/mappings/prm1k48weFSOnEUnw0g4"
ListOfSecurityEventsProviderInstances:
summary: List of Security Events Providers
value:
- id: sse1qg25RpusjUP6m0g5
name: Security Events Provider with well-known URL
type: okta
status: ACTIVE
settings:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
issuer: Issuer
jwks_url: https://example.okta.com/jwks/path
_links:
self:
href: https://example.okta.com/api/v1/security-events-providers/sse1qg25RpusjUP6m0g5
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: https://example.okta.com/api/v1/security-events-providers/sse1qg25RpusjUP6m0g5/lifecycle/deactivate
hints:
allow:
- POST
- id: sse1qu4fUtsoD12iF0g5
name: Security Events Provider with an issuer and a JWKS URL
type: okta
status: ACTIVE
settings:
issuer: Issuer
jwks_url: https://example.okta.com/jwks/path
_links:
self:
href: https://example.okta.com/api/v1/security-events-providers/sse1qu4fUtsoD12iF0g5
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: https://example.okta.com/api/v1/security-events-providers/sse1qu4fUtsoD12iF0g5/lifecycle/deactivate
hints:
allow:
- POST
ListPrivilegedAccounts:
summary: List Privileged Accounts with mixed account types
value:
- accountType: APP_ACCOUNT
description: This is for accessing AWS Prod-5
id: a747a818-a4c4-4446-8a87-704216495a08
name: AWS Prod-5 account
ownerGroupIds:
- 00g57qp78yZT2XBA40g7
ownerUserIds:
- 00u11s48P9zGW8yqm0g5
status: NO_ISSUES
statusDetail: ROTATED
created: 2023-04-04T15:56:05.000Z
lastUpdated: 2023-05-05T18:15:44.000Z
details:
credentials:
username: [email protected]
oktaApplicationId: aln1aqcs055ZRoizW0g8
appInstanceName: AWS Prod-5
appGlobalName: AWS Account Federation
- accountType: OKTA_USER_ACCOUNT
description: Shared admin account for managing AD integrations
id: d1b65a78-21ed-429b-8ea3-eec96f2748d6
name: AD Integrations Admin
ownerGroupIds:
- 00g57qp78yZT2XBA40g7
ownerUserIds:
- 00u11s48P9zGW8yqm0g5
status: INFO
statusDetail: ROTATING
created: 2023-04-04T15:56:05.000Z
lastUpdated: 2023-05-05T18:15:44.000Z
details:
credentials:
username: [email protected]
email: [email protected]
oktaUserId: 00u11s48P9zGW8yqm0g5
ListRealmAssignmentsResponse:
value:
- id: rul2jy7jLUlnO3ng00g4
status: ACTIVE
name: Realm Assignment 1
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: false
conditions:
profileSourceId: 0oa4enoRyjwSCy5hx0g4
expression:
value: user.profile.role ==\"Manager\"
actions:
assignUserToRealm:
realmId: 00g1b7rvh0xPLKXFf0g5
priority: 0
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realm-assignments/rul2jy7jLUlnO3ng00g4
method: GET
- id: rul2jy7jLUlnO5ng00g4
status: ACTIVE
name: Catch-all
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: true
conditions:
profileSourceId: "0oa4enoRyjwSCy6hx0g4,"
expression:
value: string
actions:
assignUserToRealm:
realmId: 00g1b7rvh0xPLKXFf2g5
priority: 499
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realm-assignments/rul2jy7jLUlnO5ng00g4
method: GET
ListRealmAwareUsersResponse:
summary: List all Users
value:
- id: 00u118oQYT4TBGuay0g4
status: ACTIVE
created: 2022-04-04T15:56:05.000Z
activated: null
statusChanged: null
lastLogin: 2022-05-04T19:50:52.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
passwordChanged: 2022-04-04T16:00:22.000Z
type:
id: oty1162QAr8hJjTaq0g4
profile:
firstName: Alice
lastName: Smith
mobilePhone: null
secondEmail: null
login: [email protected]
email: [email protected]
realmId: guo1afiNtSnZYILxO0g4
credentials:
password: {}
provider:
type: OKTA
name: OKTA
_links:
self:
href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4
ListRealmsResponse:
value:
- id: guox9jQ16k9V8IFEL0g3
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: false
profile:
name: Car Co
realmType: PARTNER
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realms/guox9jQ16k9V8IFEL0g3
method: GET
ListRefreshTokensClientsResponse:
summary: List all refresh tokens for a Client
value:
- id: "{refreshTokenId}"
status: ACTIVE
created: 2023-09-21T19:59:56.000Z
lastUpdated: 2023-09-21T20:00:38.000Z
expiresAt: 2023-09-28T20:00:38.000Z
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
client_id: "{clientId}"
userId: "{userId}"
scopes:
- offline_access
- openid
_embedded:
scopes:
- id: "{scopeId}"
name: openid
displayName: openid
description: Signals that a request is an OpenID request
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}"
title: openid
- id: "{scopeID}"
name: offline_access
displayName: Keep you signed in to the app
description: "This keeps you signed in to the app, even when you aren't\
\ using it."
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}"
itle: Keep you signed in to the app
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}"
title: My Web App
authorizationServer:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}"
title: Authorization Server name
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}"
revoke:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}"
hints:
allow:
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}"
title: My Web App
user:
href: "https://{yourOktaDomain}/api/v1/users/{userId}"
title: Joe User
ListRiskProviderResponse:
summary: List Risk Provider response example
value:
- id: 00rp12r4skkjkjgsn
action: log_only
name: Risk-Partner-X
clientId: 00ckjsfgjkdkjdkkljjsd
created: 2021-01-05 22:18:30
lastUpdated: 2021-01-05 22:18:30
_links:
self:
href: "https://{yourOktaDomain}/api/v1/risk/providers/00rp12r4skkjkjgsn"
hints:
allow:
- GET
- PUT
ListSessionsResponseForGetSessions:
value:
- id: aps1qqonvr2SZv6o70h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: CREATED
importType: INCREMENTAL
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T16:15:44.000Z
- id: aps1quck606ngubVq0h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: TRIGGERED
importType: INCREMENTAL
created: 2022-04-04T16:56:05.000Z
lastUpdated: 2022-05-05T17:15:44.000Z
- id: aps1qzy2acb5jDlUc0h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: IN_PROGRESS
importType: INCREMENTAL
created: 2022-04-04T17:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
- id: aps1qqne8c1JHkMdF0h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: EXPIRED
importType: INCREMENTAL
created: 2022-04-04T18:56:05.000Z
lastUpdated: 2022-05-05T19:15:44.000Z
- id: aps1qqonvr2SZv6o70h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: CLOSED
importType: INCREMENTAL
created: 2022-04-04T19:56:05.000Z
lastUpdated: 2022-05-05T20:15:44.000Z
ListThemesResponse:
value:
- id: thdul904tTZ6kWVhP0g3
logo: "https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png"
favicon: "https://{yourOktaDomain}/favicon.ico"
backgroundImage: null
primaryColorHex: '#1662dd'
primaryColorContrastHex: '#000000'
secondaryColorHex: '#ebebed'
secondaryColorContrastHex: '#000000'
signInPageTouchPointVariant: OKTA_DEFAULT
endUserDashboardTouchPointVariant: OKTA_DEFAULT
errorPageTouchPointVariant: OKTA_DEFAULT
emailTemplateTouchPointVariant: OKTA_DEFAULT
loadingPageTouchPointVariant: OKTA_DEFAULT
ListUISchemaResponse:
summary: Lists all UI Schemas response
value:
- id: uis4a7liocgcRgcxZ0g7
uiSchema:
type: Group
label: Sign in
buttonLabel: Submit
elements:
- type: Control
scope: '#/properties/firstName'
label: First name
options:
format: text
- type: Control
scope: '#/properties/lastName'
label: Last name
options:
format: text
- type: Control
scope: '#/properties/email'
label: Email
options:
format: text
- type: Control
scope: '#/properties/countryCode'
label: Country code
options:
format: select
- type: Control
scope: '#/properties/bool2'
label: bool2
options:
format: checkbox
- type: Control
scope: '#/properties/date'
label: date
options:
format: text
- type: Control
scope: '#/properties/enum'
label: enum
options:
format: radio
created: 2022-07-25T12:56:31.000Z
lastUpdated: 2022-07-26T11:53:59.000Z
_links:
self:
href: https://example.com/api/v1/meta/uischemas/uis4a7liocgcRgcxZ0g7
hints:
allow:
- GET
- PUT
- DELETE
- id: uis4abjqkkKXVPGAU0g7
uiSchema:
type: Group
label: Sign in 2
buttonLabel: Submit
elements:
- type: Control
scope: '#/properties/firstName'
label: First name
options:
format: text
- type: Control
scope: '#/properties/lastName'
label: Last name
options:
format: text
- type: Control
scope: '#/properties/email'
label: Email
options:
format: text
- type: Control
scope: '#/properties/countryCode'
label: Country code
options:
format: select
- type: Control
scope: '#/properties/bool2'
label: bool2
options:
format: checkbox
- type: Control
scope: '#/properties/date'
label: date
- type: Control
scope: '#/properties/enum'
label: enum
options:
format: radio
created: 2022-07-25T12:56:31.000Z
lastUpdated: 2022-07-26T11:53:59.000Z
_links:
self:
href: https://example.com/api/v1/meta/uischemas/uis4abjqkkKXVPGAU0g7
hints:
allow:
- GET
- PUT
- DELETE
ListUserBlocksAnyDevicesResponse:
value:
- type: DEVICE_BASED
appliesTo: ANY_DEVICES
ListUserBlocksUnknownDevicesResponse:
value:
- type: DEVICE_BASED
appliesTo: UNKNOWN_DEVICES
ListUserClients:
value:
- client_id: 0oabskvc6442nkvQO0h7
client_name: My App
client_uri: null
logo_uri: null
_links:
grants:
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants"
tokens:
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens"
ListUserGroups:
value:
- id: 0gabcd1234
profile:
name: Cloud App Users
description: Users can access cloud apps
- id: 0gefgh5678
profile:
name: Internal App Users
description: Users can access internal apps
ListUsersResponse:
summary: List all Users
value:
- id: 00u118oQYT4TBTemp0g4
status: ACTIVE
created: 2022-04-04T15:56:05.000Z
activated: null
statusChanged: null
lastLogin: 2022-05-04T19:50:52.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
passwordChanged: 2022-04-04T16:00:22.000Z
type:
id: oty1162QAr8hJjTaq0g4
profile:
firstName: Alice
lastName: Smith
mobilePhone: null
secondEmail: null
login: [email protected]
email: [email protected]
credentials:
password: {}
provider:
type: OKTA
name: OKTA
_links:
self:
href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4
ListYubikeyOptTokensResponse:
summary: List Yubikey OPT Token response
value:
- id: ykkwcx13nrDq8g4oy0g3
created: 2020-01-14T21:53:09.000Z
lastVerified: 2020-01-14T21:53:06.000Z
lastUpdated: 2020-01-14T21:53:09.000Z
status: UNASSIGNED
profile:
serial: "000003632071"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkwcx13nrDq8g4oy0g3"
hints:
allow:
- GET
- DELETE
- id: ykkxdtCA1fKVxyu6R0g3
created: 2020-06-09T23:42:05.000Z
activated: 2020-06-09T23:47:29.000Z
lastVerified: 2020-06-09T23:47:29.000Z
lastUpdated: 2020-06-09T23:47:29.000Z
status: ACTIVE
profile:
serial: "000009508427"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkxdtCA1fKVxyu6R0g3"
hints:
allow:
- GET
user:
href: "https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3"
hints:
allow:
- GET
deactivate:
href: "https://{yourOktaDomain}/api/v1/users/00uu0x8sxTr9HcHOo0g3/factors/ykfxduQAhl89YyPrV0g3"
hints:
allow:
- DELETE
ListsAllUserTypes:
summary: Lists all user types
value:
- id: otyfnly5cQjJT9PnR0g4
displayName: New User Type
name: newUserType
description: A new custom user type
createdBy: sprz9fj1ycBcsgopy1d6
lastUpdatedBy: sprz9fj1ycBcsgopy1d6
created: 2021-07-05T20:40:38.000Z
lastUpdated: 2021-07-05T20:40:38.000Z
default: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
- id: otyz9fj2jMiRBC1ZT1d6
displayName: User
name: user
description: Okta user profile template with default permission settings
createdBy: sprz9fj1ycBcsgopy1d6
lastUpdatedBy: sprz9fj1ycBcsgopy1d6
created: 2021-07-05T20:40:38.000Z
lastUpdated: 2021-07-05T20:40:38.000Z
default: true
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
ListsOwnerOneResponse:
summary: Lists a response with one owner
value:
- id: 00g1gae1k0znUcLuU0h8
type: GROUP
resolved: true
originId: "null"
originType: OKTA_DIRECTORY
displayName: Product & Engineering
lastUpdated: 2023-03-29 18:18:37.0
ListsOwnersMultipleResponse:
summary: Lists a response with multiple owners
value:
- id: 00u1cmbqjkkmFXeqb0h8
type: USER
resolved: true
originId: "null"
originType: OKTA_DIRECTORY
displayName: Mabel Mora
lastUpdated: 2023-03-29T18:30:58.000Z
- id: 00u1cmc52x5B86cnZ0h8
type: USER
resolved: true
originId: "null"
originType: OKTA_DIRECTORY
displayName: Cinda Canning
lastUpdated: 2023-03-29T18:30:55.000Z
LogStreamActivateResponse:
summary: Activate Log Stream response
value:
id: 0oa1orqUGCIoCGNxf0g4
type: aws_eventbridge
name: Example AWS EventBridge
lastUpdated: 2023-03-24T21:22:43.000Z
created: 2023-03-24T21:02:43.000Z
status: ACTIVE
settings:
accountId: "123456789012"
eventSourceName: your-event-source-name
region: us-east-2
_links:
self:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4"
method: GET
deactivate:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4/lifecycle/deactivate"
method: POST
LogStreamDeactivateResponse:
summary: Deactivate Log Stream response
value:
id: 0oa7agphh5FT7H521d7
type: splunk_cloud_logstreaming
name: Splunk Cloud Example
lastUpdated: 2023-03-24T21:23:00.000Z
created: 2023-03-24T21:15:13.000Z
status: INACTIVE
settings:
edition: aws
host: okexample.splunkcloud.com
_links:
self:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa7agphh5FT7H521d7"
method: GET
activate:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa7agphh5FT7H521d7/lifecycle/activate"
method: POST
LogStreamGetAllResponse:
summary: Lists all Log Streams
value:
- id: 0oa1orqUGCIoCGNxf0g4
type: aws_eventbridge
name: Example AWS EventBridge
lastUpdated: 2023-03-24T21:02:43.000Z
created: 2023-03-24T21:02:43.000Z
status: ACTIVE
settings:
accountId: "123456789012"
eventSourceName: your-event-source-name
region: us-east-2
_links:
self:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4"
method: GET
deactivate:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4/lifecycle/deactivate"
method: POST
LogStreamPostRequest:
summary: Create an AWS EventBridge Log Stream
value:
type: aws_eventbridge
name: Example AWS EventBridge
settings:
eventSourceName: your-event-source-name
accountId: "123456789012"
region: us-east-2
LogStreamPostResponse:
summary: AWS EventBridge Log Stream response
value:
id: 0oa1orqUGCIoCGNxf0g4
type: aws_eventbridge
name: Example AWS EventBridge
lastUpdated: 2023-03-24T21:02:43.000Z
created: 2023-03-24T21:02:43.000Z
status: ACTIVE
settings:
accountId: "123456789012"
eventSourceName: your-event-source-name
region: us-east-2
_links:
self:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4"
method: GET
deactivate:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4/lifecycle/deactivate"
method: POST
LogStreamPutRequest:
summary: Replace AWS EventBridge name
value:
type: aws_eventbridge
name: Updated AWS EventBridge
settings:
eventSourceName: your-event-source-name
accountId: "123456789012"
region: us-east-2
LogStreamPutResponse:
summary: Replace AWS EventBridge name response
value:
id: 0oa1orqUGCIoCGNxf0g4
type: aws_eventbridge
name: Updated AWS EventBridge
lastUpdated: 2023-03-24T21:12:43.000Z
created: 2023-03-24T21:02:43.000Z
status: ACTIVE
settings:
accountId: "123456789012"
eventSourceName: your-event-source-name
region: us-east-2
_links:
self:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4"
method: GET
deactivate:
href: "http://{yourOktaDomain}/api/v1/logStreams/0oa1orqUGCIoCGNxf0g4/lifecycle/deactivate"
method: POST
LogStreamSchemaAws:
value:
$schema: https://json-schema.org/draft/2020-12/schema
$id: "http://{yourOktaDomain}/api/v1/meta/schemas/logStream/aws_eventbridge"
title: AWS EventBridge
type: object
properties:
settings:
description: Configuration properties specific to AWS EventBridge
type: object
properties:
accountId:
title: AWS Account ID
description: Your Amazon AWS Account ID.
type: string
writeOnce: true
pattern: "^\\d{12}$"
eventSourceName:
title: AWS Event Source Name
description: An alphanumeric name (no spaces) to identify this event
source in AWS EventBridge.
type: string
writeOnce: true
pattern: "^[\\.\\-_A-Za-z0-9]{1,75}$"
region:
title: AWS Region
description: The destination AWS region for your system log events.
type: string
writeOnce: true
oneOf:
- title: US East (Ohio)
const: us-east-2
- title: US East (N. Virginia)
const: us-east-1
- title: US West (N. California)
const: us-west-1
- title: US West (Oregon)
const: us-west-2
- title: Canada (Central)
const: ca-central-1
- title: Europe (Frankfurt)
const: eu-central-1
- title: Europe (Ireland)
const: eu-west-1
- title: Europe (London)
const: eu-west-2
- title: Europe (Paris)
const: eu-west-3
- title: Europe (Milan)
const: eu-south-1
- title: Europe (Stockholm)
const: eu-north-1
required:
- eventSourceName
- accountId
- region
errorMessage:
properties:
accountId: Account number must be 12 digits.
eventSourceName: "Event source name can use numbers, letters, the\
\ symbols \".\", \"-\" or \"_\". It must use fewer than 76 characters."
name:
title: Name
description: A name for this log stream in Okta
type: string
writeOnce: false
pattern: "^.{1,100}$"
required:
- name
- settings
errorMessage:
properties:
name: Name can't exceed 100 characters.
LogStreamSchemaList:
value:
- $schema: https://json-schema.org/draft/2020-12/schema
$id: "http://{yourOktaDomain}/api/v1/meta/schemas/logStream/aws_eventbridge"
title: AWS EventBridge
type: object
properties:
settings:
description: Configuration properties specific to AWS EventBridge
type: object
properties:
accountId:
title: AWS Account ID
description: Your Amazon AWS Account ID.
type: string
writeOnce: true
pattern: "^\\d{12}$"
eventSourceName:
title: AWS Event Source Name
description: An alphanumeric name (no spaces) to identify this event
source in AWS EventBridge.
type: string
writeOnce: true
pattern: "^[\\.\\-_A-Za-z0-9]{1,75}$"
region:
title: AWS Region
description: The destination AWS region for your system log events.
type: string
writeOnce: true
oneOf:
- title: US East (Ohio)
const: us-east-2
- title: US East (N. Virginia)
const: us-east-1
- title: US West (N. California)
const: us-west-1
- title: US West (Oregon)
const: us-west-2
- title: Canada (Central)
const: ca-central-1
- title: Europe (Frankfurt)
const: eu-central-1
- title: Europe (Ireland)
const: eu-west-1
- title: Europe (London)
const: eu-west-2
- title: Europe (Paris)
const: eu-west-3
- title: Europe (Milan)
const: eu-south-1
- title: Europe (Stockholm)
const: eu-north-1
required:
- eventSourceName
- accountId
- region
errorMessage:
properties:
accountId: Account number must be 12 digits.
eventSourceName: "Event source name can use numbers, letters, the\
\ symbols \".\", \"-\" or \"_\". It must use fewer than 76 characters."
name:
title: Name
description: A name for this log stream in Okta
type: string
writeOnce: false
pattern: "^.{1,100}$"
required:
- name
- settings
errorMessage:
properties:
name: Name can't exceed 100 characters.
- $schema: https://json-schema.org/draft/2020-12/schema
id: "http://{yourOktaDomain}/api/v1/meta/schemas/logStream/splunk_cloud_logstreaming"
title: Splunk Cloud
type: object
properties:
settings:
description: Configuration properties specific to Splunk Cloud
type: object
properties:
host:
title: Host
description: "The domain for your Splunk Cloud instance without http\
\ or https. For example: acme.splunkcloud.com"
type: string
writeOnce: false
pattern: "^([a-z0-9]+(-[a-z0-9]+)*){1,100}\\.splunkcloud(gc|fed)?\\\
.com$"
token:
title: HEC Token
description: The token from your Splunk Cloud HTTP Event Collector
(HEC).
type: string
writeOnce: false
pattern: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
required:
- host
- token
errorMessage:
properties:
host: "Host should be a domain without http or https. For example:\
\ acme.splunkcloud.com"
name:
title: Name
description: A name for this log stream in Okta
type: string
writeOnce: false
pattern: "^.{1,100}$"
required:
- name
- settings
errorMessage:
properties:
name: Name can't exceed 100 characters.
LogStreamSchemaSplunk:
value:
$schema: https://json-schema.org/draft/2020-12/schema
id: "http://{yourOktaDomain}/api/v1/meta/schemas/logStream/splunk_cloud_logstreaming"
title: Splunk Cloud
type: object
properties:
settings:
description: Configuration properties specific to Splunk Cloud
type: object
properties:
host:
title: Host
description: "The domain for your Splunk Cloud instance without http\
\ or https. For example: acme.splunkcloud.com"
type: string
writeOnce: false
pattern: "^([a-z0-9]+(-[a-z0-9]+)*){1,100}\\.splunkcloud(gc|fed)?\\\
.com$"
token:
title: HEC Token
description: The token from your Splunk Cloud HTTP Event Collector
(HEC).
type: string
writeOnce: false
pattern: "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}"
required:
- host
- token
errorMessage:
properties:
host: "Host should be a domain without http or https. For example:\
\ acme.splunkcloud.com"
name:
title: Name
description: A name for this log stream in Okta
type: string
writeOnce: false
pattern: "^.{1,100}$"
required:
- name
- settings
errorMessage:
properties:
name: Name can't exceed 100 characters.
LogTargetChangeDetails:
summary: Example of the `changeDetails` property on the target
value:
from:
vpnLocationOptions: DISABLED
vpnSettingsZones:
include: null
exclude: null
to:
message: You must a use VPN to connect to this application
vpnLocationOptions: ZONE
vpnSettingsZones:
include:
- ALL_ZONES
exclude: null
MicrosoftIdPResponse:
summary: Microsoft Identity Provider
value:
id: 0oajmvdFawBih4gey0g3
type: MICROSOFT
name: Microsoft
status: ACTIVE
created: 2016-03-29T16:47:36.000Z
lastUpdated: 2016-03-29T16:47:36.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
binding: HTTP-REDIRECT
token:
url: https://login.microsoftonline.com/common/oauth2/v2.0/token
binding: HTTP-POST
scopes:
- openid
- email
- profile
- https://graph.microsoft.com/User.Read
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: |-
https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&
client_id={clientId}&response_type={responseType}&response_mode={responseMode}&
scope={scopes}&redirect_uri={redirectUri}&state={state}
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
MultipleIdPCsrsResponse:
summary: Identity Provider CSRs
value:
- id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50
created: 2017-03-28T01:11:10.000Z
csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
kty: RSA
_links:
self:
href: "https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50"
hints:
allow:
- GET
- DELETE
publish:
href: "https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish"
hints:
allow:
- POST
- id: -_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg
created: 2017-03-28T01:21:10.000Z
csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
kty: RSA
_links:
self:
href: "https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg"
hints:
allow:
- GET
- DELETE
publish:
href: "https://{yourOktaDomain}/api/v1/idps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/-_-BFwAGoUYN-DDvsSKQFdx7OXaPZqrEPpFDO1hu-rg/lifecycle/publish"
hints:
allow:
- POST
MultipleIdPKeyCredentialsResponse:
summary: Identity Provider Key Credentials
value:
- kid: your-key-id
created: 2016-01-03T18:15:47.000Z
lastUpdated: 2016-01-03T18:15:47.000Z
e: "65537"
"n": "101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747"
kty: RSA
use: sig
x5c:
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE
- kty: EC
created: 2020-04-24T20:51:20.000Z
lastUpdated: 2020-04-24T20:51:20.000Z
expiresAt: 2040-03-01T20:22:29.000Z
alg: EC
x5c:
- MIICqDCCAgqgAwIBAgIJAOkmCa/S8dHiMAoGCCqGSM49BAMCMG0xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMRAwDgYDVQQKDAdKYW5reUNvMR8wHQYDVQQDDBZUZXN0IElkZW50aXR5IFByb3ZpZGVyMB4XDTIwMDMwNjIwMjIyOVoXDTQwMDMwMTIwMjIyOVowbTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEDAOBgNVBAoMB0phbmt5Q28xHzAdBgNVBAMMFlRlc3QgSWRlbnRpdHkgUHJvdmlkZXIwgZswEAYHKoZIzj0CAQYFK4EEACMDgYYABABW/lGHl17mKDtCD4D7gcMYYOWgyWTGno8MTefDOABA8PddessTsbfrguF49Gli6lCzrZaAKhhvgINc3R6t/dYleAE3lY6LAocOoLe9xDkeggXNcSuP5fDc1x5R9GHTXl44vLoJOLSLsMbOXVMXIXoqbPDzTSYUy24aFdv4W4LZxW6ak6NQME4wHQYDVR0OBBYEFChTXNWvs4z1qjRVemPDD/hqlDQ4MB8GA1UdIwQYMBaAFChTXNWvs4z1qjRVemPDD/hqlDQ4MAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDgYsAMIGHAkIBuDhHMNLbBIsorbKtjxJzHJ2ItCSD2wAwqYv/6JBtA2ulKN5gRTSqdNCnqFsZ1/nYY7FFVXHEuQ2N3pPq7Ri8h84CQSgCq1UQyd0lFtb7+57JbiGb6LVaRqRm7vwx8zLRA+tVjIM1DlQ2Gbxkj3nlkzmM93j9wchiqGdQidyKnF6EBnfd
x: Vv5Rh5de5ig7Qg-A-4HDGGDloMlkxp6PDE3nwzgAQPD3XXrLE7G364LhePRpYupQs62WgCoYb4CDXN0erf3WJXg
"y": ATeVjosChw6gt73EOR6CBc1xK4_l8NzXHlH0YdNeXji8ugk4tIuwxs5dUxcheips8PNNJhTLbhoV2_hbgtnFbpqT
crv: P-521
kid: your-kid
use: sig
x5t#S256: TUx-AIwypm2pZURHNqafk7ZDxqQP_ypzIyUwDDnPOlw
MultipleIdPSigningKeyCredentialsResponse:
summary: Identity Provider Signing Key Credentials
value:
- created: 2015-12-10T18:56:23.000Z
expiresAt: 2017-12-10T18:56:22.000Z
x5c:
- MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw==
kid: akm5hvbbevE341ovl0h7
kty: RSA
use: sig
x5t#S256: 5GOpy9CQVtfvBmu2T8BHvpKE4OGtC3BuS046t7p9pps
- created: 2015-12-10T18:55:35.000Z
expiresAt: 2045-01-23T02:15:23.000Z
x5c:
- MIIDqDCCApCgAwIBAgIGAVGNQFX5MA0GCSqGSIb3DQEBBQUAMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTAeFw0xNTEyMTAxODU1MjJaFw0xNzEyMTAxODU2MjJaMIGUMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxFTATBgNVBAMMDGJhbGFjb21wdGVzdDEcMBoGCSqGSIb3DQEJARYNaW5mb0Bva3RhLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJJjrcnI6cXBiXNq9YDgfYrQe2O5qEHG4MXP8Ue0sMeefFkFEHYHnHUeZCq6WTAGqR+1LFgOl+Eq9We5V+qNlGIfkFkQ3iHGBrIALKqLCd0Et76HicDiegz7j9DtN+lo0hG/gfcw5783L5g5xeQ7zVmCQMkFwoUA0uA3bsfUSrmfORHJL+EMNQT8XIXD8NkG4g6u7ylHVRTLgXbe+W/p04m3EP6l41xl+MhIpBaPxDsyUvcKCNwkZN3aZIin1O9Y4YJuDHxrM64/VtLLp0sC05iawAmfsLunF7rdJAkWUpPn+xkviyNQ3UpvwAYuDr+jKLUdh2reRnm1PezxMIXzBVMCAwEAATANBgkqhkiG9w0BAQUFAAOCAQEARnFIjyitrCGbleFr3KeAwdOyeHiRmgeKupX5ZopgXtcseJoToUIinX5DVw2fVZPahqs0Q7/a0wcVnTRpw6946qZCwKd/PvZ1feVuVEA5Ui3+XvHuSH5xLp7NvYG1snNEvlbN3+NDUMlWj2NEbihowUBt9+UxTpQO3+N08q3aZk3hOZ+tHt+1Te7KEEL/4CM28GZ9MY7fSrS7MAgp1+ZXtn+kRlMrXnQ49qBda37brwDRqmSY9PwNMbev3r+9ZHwxr9W5wXW4Ev4C4xngA7RkVoyDbItSUho0I0M0u/LHuppclnXrw97xyO5Z883eIBvPVjfRcxsJxXJ8jx70ATDskw==
kid: akm5hvbn1vojA9Fsa0h7
kty: RSA
use: sig
x5t#S256: 7CCyXWwKzH4P6PoBP91B1S_iIZVzuGffVnUXu-BTYQQ
MultipleIdPsResponse:
summary: Multiple Identity Providers
value:
- id: 0oa62b57p7c8PaGpU0h7
type: FACEBOOK
name: Facebook
status: ACTIVE
created: 2016-03-24T23:18:27.000Z
lastUpdated: 2016-03-24T23:18:27.000Z
protocol:
type: OAUTH2
endpoints:
authorization:
url: https://www.facebook.com/dialog/oauth
binding: HTTP-REDIRECT
token:
url: https://graph.facebook.com/v2.5/oauth/access_token
binding: HTTP-POST
scopes:
- public_profile
- email
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62b57p7c8PaGpU0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}"
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
- id: 0oa62bc8wppPw0UGr0h7
type: SAML2
name: Example SAML IdP
status: ACTIVE
created: 2016-03-24T23:14:54.000Z
lastUpdated: 2016-03-24T23:14:54.000Z
protocol:
type: SAML2
endpoints:
sso:
url: https://idp.example.com
binding: HTTP-POST
destination: https://idp.example.com
acs:
binding: HTTP-POST
type: INSTANCE
algorithms:
request:
signature:
algorithm: SHA-256
scope: REQUEST
response:
signature:
algorithm: SHA-256
scope: ANY
settings:
nameFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
credentials:
trust:
issuer: https://idp.example.com
audience: http://www.okta.com/123
kid: your-key-id
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: saml.subjectNameId
filter: (\S+@example\.com)
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
metadata:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml"
type: application/xml
hints:
allow:
- GET
acs:
href: "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7"
type: application/xml
hints:
allow:
- POST
users:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users"
hints:
allow:
- GET
deactivate:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate"
hints:
allow:
- POST
- id: 0oa62bfdiumsUndnZ0h7
type: GOOGLE
name: Google
status: ACTIVE
created: 2016-03-24T23:21:49.000Z
lastUpdated: 2016-03-24T23:21:49.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://accounts.google.com/o/oauth2/auth
binding: HTTP-REDIRECT
token:
url: https://www.googleapis.com/oauth2/v3/token
binding: HTTP-POST
scopes:
- profile
- email
- openid
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdiumsUndnZ0h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}"
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
- id: 0oa62bfdjnK55Z5x80h7
type: LINKEDIN
name: LinkedIn
status: ACTIVE
created: 2016-03-24T23:23:59.000Z
lastUpdated: 2016-03-24T23:23:59.000Z
protocol:
type: OAUTH2
endpoints:
authorization:
url: https://www.linkedin.com/uas/oauth2/authorization
binding: HTTP-REDIRECT
token:
url: https://www.linkedin.com/uas/oauth2/accessToken
binding: HTTP-POST
scopes:
- r_basicprofile
- r_emailaddress
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oa62bfdjnK55Z5x80h7&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}"
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
- id: 0oajmvdFawBih4gey0g3
type: MICROSOFT
name: Microsoft
status: ACTIVE
created: 2016-03-29T16:47:36.000Z
lastUpdated: 2016-03-29T16:47:36.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://login.microsoftonline.com/common/oauth2/v2.0/authorize
binding: HTTP-REDIRECT
token:
url: https://login.microsoftonline.com/common/oauth2/v2.0/token
binding: HTTP-POST
scopes:
- openid
- email
- profile
- https://graph.microsoft.com/User.Read
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.userPrincipalName
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oajmvdFawBih4gey0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}"
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
- id: 0oaulob4BFVa4zQvt0g3
type: OIDC
name: Example OpenID Connect IdP
status: ACTIVE
created: 2019-02-07T20:07:47.000Z
lastUpdated: 2019-02-07T20:07:47.000Z
protocol:
type: OIDC
endpoints:
authorization:
url: https://idp.example.com/authorize
binding: HTTP-REDIRECT
token:
url: https://idp.example.com/token
binding: HTTP-POST
userInfo:
url: https://idp.example.com/userinfo
binding: HTTP-REDIRECT
jwks:
url: https://idp.example.com/keys
binding: HTTP-REDIRECT
scopes:
- openid
issuer:
url: https://idp.example.com
credentials:
client:
client_id: your-client-id
client_secret: your-client-secret
policy:
provisioning:
action: AUTO
profileMaster: false
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.email
filter: null
matchType: USERNAME
matchAttribute: null
mapAMRClaims: false
maxClockSkew: 0
_links:
authorize:
href: "https://{yourOktaDomain}/oauth2/v1/authorize?idp=0oaulob4BFVa4zQvt0g3&client_id={clientId}&response_type={responseType}&response_mode={responseMode}&scope={scopes}&redirect_uri={redirectUri}&state={state}&nonce={nonce}"
templated: true
hints:
allow:
- GET
clientRedirectUri:
href: "https://{yourOktaDomain}/oauth2/v1/authorize/callback"
hints:
allow:
- POST
- id: 0oa6jxasyhwM2ZHJh0g4
type: X509
name: Smart Card IDP Name
status: ACTIVE
created: 2020-01-07T00:19:27.000Z
lastUpdated: 2020-01-07T00:19:27.000Z
properties:
additionalAmr:
- sc
- hwk
- pin
- mfa
protocol:
type: MTLS
endpoints:
sso:
url: "https://{yourOktaDomain}.okta.com/login/cert"
credentials:
trust:
issuer: "CN=Test Smart Card, OU=Test OU, O=Test O, C=US"
audience: null
kid: 45dec5ff-8cdc-48c0-85fe-a4869f1753dc
revocation: CRL
revocationCacheLifetime: 2880
policy:
provisioning:
action: DISABLED
profileMaster: false
groups: null
subject:
userNameTemplate:
template: idpuser.subjectAltNameEmail
filter: null
matchType: EMAIL
matchAttribute: null
mapAMRClaims: false
maxClockSkew: 0
_links:
deactivate:
href: "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate"
hints:
allow:
- POST
users:
href: "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users"
hints:
allow:
- GET
keys:
href: "https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc"
hints:
allow:
- GET
NextAuthorizationServerKey:
summary: Next Authorization Server Key
value:
status: NEXT
alg: RS256
e: AQAB
"n": l1hZ_g2sgBE3oHvu34T-5XP18FYJWgtul_nRNg-5xra5ySkaXEOJUDRERUG0HrR42uqf9jYrUTwg9fp-SqqNIdHRaN8EwRSDRsKAwK
3 HIJ2NJfgmrrO2ABkeyUq6rzHxAumiKv1iLFpSawSIiTEBJERtUCDcjbbqyHVFuivIFgH8L37
- XDIDb0XG - R8DOoOHLJPTpsgH - rJe M5w96VIRZInsGC5OGWkFdtgk6OkbvVd7_TXcxLCpWeg1vlbmX
- 0 TmG5yjSj7ek05txcpxIqYu - 7 FIGT0KKvXge_BOSEUlJpBhLKU28 OtsOnmc3NLIGXB
- GeDiUZiBYQdPR - myB4ZoQ
kid: Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo
kty: RSA
use: sig
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/keys/Y3vBOdYT-l-I0j-gRQ26XjutSX00TeWiSguuDhW3ngo"
hints:
allow:
- GET
NzErrorApiValidationFailed:
summary: API Validation Failed
value:
errorCode: E0000003
errorSummary: The request body was not well-formed.
errorLink: E0000003
errorId: samplewNxQUR9iohr4QYlD0eg
errorCauses: []
NzErrorResourceNotFound:
summary: Resource Not Found
value:
errorCode: E0000007
errorSummary: "Not found: Resource not found: itd (NetworkZone)"
errorLink: E0000007
errorId: samplejCSVaKFDkCMElmKQ
errorCauses: []
OAuth2RefreshTokenResponseEx:
summary: OAuth 2.0 refresh token example
value:
id: oar579Mcp7OUsNTlo0g3
status: ACTIVE
created: 2023-03-09T03:18:06.000Z
lastUpdated: 2023-03-09T03:18:06.000Z
expiresAt: 2023-03-16T03:18:06.000Z
issuer: "https://{yourOktaDomain}/oauth2/ausain6z9zIedDCxB0h7"
clientId: 0oabskvc6442nkvQO0h7
userId: 00u5t60iloOHN9pBi0h7
scopes:
- offline_access
- car:drive
_embedded:
scopes:
- id: scppb56cIl4GvGxy70g3
name: offline_access
description: Requests a refresh token by default and is used to obtain
more access tokens without re-prompting the user for authentication
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3"
title: offline_access
- id: scp142iq2J8IGRUCS0g4
name: car:drive
displayName: Drive car
description: Allows the user to drive a car
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scp142iq2J8IGRUCS0g4"
title: Drive car
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7"
title: Native
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
revoke:
href: "https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
hints:
allow:
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0oabskvc6442nkvQO0h7"
title: Example Client App
user:
href: "https://{yourOktaDomain}/api/v1/users/00upcgi9dyWEOeCwM0g3"
title: Saml Jackson
authorizationServer:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7"
title: Example Authorization Server
OAuth2RefreshTokenResponseListEx:
summary: App refresh token list example
value:
- id: oar579Mcp7OUsNTlo0g3
status: ACTIVE
created: 2023-03-09T03:18:06.000Z
lastUpdated: 2023-03-09T03:18:06.000Z
expiresAt: 2023-03-16T03:18:06.000Z
issuer: "https://{yourOktaDomain}/oauth2/ausain6z9zIedDCxB0h7"
clientId: 0oabskvc6442nkvQO0h7
userId: 00u5t60iloOHN9pBi0h7
scopes:
- offline_access
- car:drive
_embedded:
scopes:
- id: scppb56cIl4GvGxy70g3
name: offline_access
description: Requests a refresh token by default and is used to obtain
more access tokens without re-prompting the user for authentication
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3"
title: offline_access
- id: scp142iq2J8IGRUCS0g4
name: car:drive
displayName: Drive car
description: Allows the user to drive a car
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scp142iq2J8IGRUCS0g4"
title: Drive car
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7"
title: Native
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
revoke:
href: "https://{yourOktaDomain}/api/v1/apps/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
hints:
allow:
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0oabskvc6442nkvQO0h7"
title: Example Client App
user:
href: "https://{yourOktaDomain}/api/v1/users/00upcgi9dyWEOeCwM0g3"
title: Saml Jackson
authorizationServer:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7"
title: Example Authorization Server
OpenidConnectEx:
summary: OPENID_CONNECT
value:
name: oidc_client
label: Sample Client profile
signOnMode: OPENID_CONNECT
credentials:
oauthClient:
token_endpoint_auth_method: client_secret_post
profile:
label: oauth2 client app 1
settings:
oauthClient:
client_uri: http://localhost:8080
logo_uri: http://developer.okta.com/assets/images/logo-new.png
redirect_uris:
- https://example.com/oauth2/callback
- myapp://callback
response_types:
- token
- id_token
- code
grant_types:
- authorization_code
application_type: native
participate_slo: false
OpenidConnectPutEx:
summary: OPENID_CONNECT
value:
name: oidc_client
label: Sample Client profile updated
signOnMode: OPENID_CONNECT
OpenidConnectPutResponseEx:
summary: OPENID_CONNECT
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: true
web: true
appLinks:
oidc_client_link: true
name: oidc_client
label: Sample Client profile updated
features: []
signOnMode: OPENID_CONNECT
credentials:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
signing:
kid: H34mvc6VrfV5yvy5wA8ikMFws6WInx4nvsAs-7EYbVc
oauthClient:
autoKeyRotation: true
client_id: 0oahonkqCRR6TSNlg4
client_secret: wj9bOsLK0BRNJqy7KMMnaE7m8qrW51bPO2n1-PYvkOmhHRYgcuOecQkEwq9MPYa5
token_endpoint_auth_method: client_secret_post
pkce_required: true
settings:
app: {}
oauthClient:
client_uri: http://localhost:8080
logo_uri: http://developer.okta.com/assets/images/logo-new.png
redirect_uris:
- https://example.com/oauth2/callback
- myapp://callback
response_types:
- token
- id_token
- code
grant_types:
- authorization_code
application_type: native
issuer_mode: DYNAMIC
idp_initiated_login:
mode: DISABLED
default_scope: []
wildcard_redirect: DISABLED
dpop_bound_access_tokens: false
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
OpenidConnectResponseEx:
summary: OPENID_CONNECT
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: true
web: true
appLinks:
oidc_client_link: true
name: oidc_client
label: Sample Client profile
features: []
signOnMode: OPENID_CONNECT
credentials:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
signing:
kid: H34mvc6VrfV5yvy5wA8ikMFws6WInx4nvsAs-7EYbVc
oauthClient:
autoKeyRotation: true
client_id: 0oahonkqCRR6TSNlg4
client_secret: wj9bOsLK0BRNJqy7KMMnaE7m8qrW51bPO2n1-PYvkOmhHRYgcuOecQkEwq9MPYa5
token_endpoint_auth_method: client_secret_post
pkce_required: true
settings:
app: {}
oauthClient:
client_uri: http://localhost:8080
logo_uri: http://developer.okta.com/assets/images/logo-new.png
redirect_uris:
- https://example.com/oauth2/callback
- myapp://callback
response_types:
- token
- id_token
- code
grant_types:
- authorization_code
application_type: native
issuer_mode: DYNAMIC
idp_initiated_login:
mode: DISABLED
default_scope: []
wildcard_redirect: DISABLED
dpop_bound_access_tokens: false
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
profile:
label: oauth2 client app 1
OperationResponse:
value:
id: rre4mje4ez6B2a7B60g7
type: realm:assignment
status: COMPLETED
created: 2023-10-25T21:02:54.000Z
started: 2023-10-25T21:02:54.000Z
completed: 2023-10-25T21:02:54.000Z
realmId: 00g1b7rvh0xPLKXFf0g5
realmName: Realm Name
assignmentOperation:
configuration:
id: 0pr1b7rxZj2ibQzfP0g5
name: Realm Assignment 1
conditions:
profileSourceId: 0oa4enoRyjwSCy5hx0g4
expression:
value: string
actions:
assignUserToRealm:
realmId: 00g1b7rvh0xPLKXFf0g5
numUserMoved: 50
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/operations/rre4mje4ez6B2a7B60g7
method: GET
OptInStatusResponse:
summary: Opt in response
value:
optInStatus: OPTING_IN
_links:
optInStatus:
href: http://your-subdomain.okta.com/api/v1/iam/governance/optIn
OptOutStatusResponse:
summary: Opt out response
value:
optInStatus: OPTING_OUT
_links:
optInStatus:
href: http://your-subdomain.okta.com/api/v1/iam/governance/optIn
OrgCAPTCHASettingsConfigured:
summary: Org-wide Captcha Settings are configured
value:
captchaId: abcd4567
enabledPages:
- SSR
- SIGN_IN
_links:
self:
href: https://your-subdomain.okta.com/api/v1/captchas/abcd4567
hints:
allow:
- GET
- POST
- PUT
- DELETE
OrgCAPTCHASettingsDisable:
summary: Disable Org-wide Captcha Settings
value:
captchaId: "null"
enabledPages: "null"
OrgCAPTCHASettingsDisabled:
summary: Disabled Org-wide Captcha Settings
value:
captchaId: "null"
enabledPages: "[]"
_links:
self:
href: https://your-subdomain.okta.com/api/v1/captchas/
hints:
allow:
- GET
- PUT
OrgCAPTCHASettingsEmpty:
summary: Org-wide Captcha Settings aren't configured
value:
captchaId: null
enabledPages: []
_links:
self:
href: https://your-subdomain.okta.com/api/v1/captchas
hints:
allow:
- GET
- POST
- PUT
- DELETE
OrgCAPTCHASettingsUpdate:
summary: Update Org-wide Captcha Settings
value:
captchaId: abcd4567
enabledPages:
- SSR
- SIGN_IN
OrgCAPTCHASettingsUpdated:
summary: Updated Org-wide Captcha Settings
value:
captchaId: abcd4567
enabledPages:
- SSR
- SIGN_IN
_links:
self:
href: https://your-subdomain.okta.com/api/v1/captchas/abcd4567
hints:
allow:
- GET
- POST
- PUT
- DELETE
OrgSettingResponse:
summary: Org setting response
value:
address1: 100 1st St
address2: 6th floor
city: San Fransico
companyName: okta
country: United States
endUserSupportHelpURL: support.okta.com
phoneNumber: "+18887227871"
postalCode: "94105"
state: California
supportPhoneNumber: "+18887227871"
website: www.okta.com
id: 00o3qqiw0vSCIwu8I0g7
created: 2024-01-24T14:15:22Z
lastUpdated: 2024-07-21T14:15:22Z
expiresAt: 2024-12-24T14:15:22Z
status: ACTIVE
subdomain: okta
_links:
preferences:
href: "https://{yourOktaDomain}/v1/org/preferences"
uploadLogo:
href: "https://{yourOktaDomain}/api/v1/org/logo"
hints:
allow:
- POST
oktaCommunication:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication"
logo: null
oktaSupport:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport"
contacts:
href: https://vantest.oktapreview.com/api/v1/org/contacts
PasswordImportPayloadExample:
summary: An example password import inline hook request body
value:
eventId: 3o9jBzq1SmOGmmsDsqyyeQ
eventTime: 2020-01-17T21:23:56.000Z
eventType: com.okta.user.credential.password.import
eventTypeVersion: "1.0"
contentType: application/json
cloudEventVersion: "0.1"
source: "https://${yourOktaDomain}/api/v1/inlineHooks/cbl2ad6phv9fsPLcF0g7"
data:
context:
request:
id: XiIl6wn7005Rr@fjYqeC7CCDBxw
method: POST
url:
value: /idp/idx/challenge/answer
ipAddress: 66.124.153.138
credential:
username: [email protected]
password: Okta
action:
credential: UNVERIFIED
PasswordImportUnVerifiedResponse:
summary: A sample response for an unverified user password
value:
commands:
- type: com.okta.action.update
value:
credential: UNVERIFIED
PasswordImportVerifiedResponse:
summary: A sample response for a verified user password
value:
commands:
- type: com.okta.action.update
value:
credential: VERIFIED
PerClientRateLimitSettingsEnforceDefault:
value:
defaultMode: ENFORCE
PerClientRateLimitSettingsEnforceDefaultWithOverrides:
value:
defaultMode: ENFORCE
useCaseModeOverrides:
OAUTH2_AUTHORIZE: PREVIEW
OIE_APP_INTENT: DISABLE
PerClientRateLimitSettingsPreviewDefaultWithOverrides:
value:
defaultMode: PREVIEW
useCaseModeOverrides:
LOGIN_PAGE: ENFORCE
PermissionResponse:
value:
label: okta.users.manage
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.manage"
PermissionResponseWithConditions:
value:
label: okta.users.read
conditions:
include:
okta:ResourceAttribute/User/Profile:
- city
- state
- zipCode
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.read"
PermissionsResponse:
value:
permissions:
- label: okta.users.create
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.create"
- label: okta.users.read
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
conditions:
include:
okta:ResourceAttribute/User/Profile:
- city
- state
- zipCode
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.read"
- label: okta.groups.read
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.groups.read"
- label: okta.users.userprofile.manage
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions/okta.users.userprofile.manage"
PreviewEmailCustomizationResponse:
value:
subject: Welcome to Okta!
body: "
Hello, John. Click here to activate your account."
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/customizations/oel2kk1zYJBJbeaGo0g4/preview"
hints:
allow:
- GET
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
test:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test"
hints:
allow:
- POST
PreviewEmailTemplateDefaultContentResponse:
value:
subject: Welcome to Okta!
body: "
Hello, John. Click here to activate your account."
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/default-content/preview"
hints:
allow:
- GET
template:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation"
hints:
allow:
- GET
defaultContent:
href: "https://{yourOktaDomain}/api/v1/brands/{brandId}/templates/email/UserActivation/test/default-content"
hints:
allow:
- POST
PrincipalRateLimitEntityRequestEmptyPercentages:
value:
principalId: token1234
principalType: SSWS_TOKEN
PrincipalRateLimitEntityRequestSSWSToken:
value:
principalId: token1234
principalType: SSWS_TOKEN
defaultPercentage: 50
defaultConcurrencyPercentage: 75
PrincipalRateLimitEntityResponseSSWSToken:
value:
id: abcd1234
orgId: org1234
principalId: token1234
principalType: SSWS_TOKEN
defaultPercentage: 50
defaultConcurrencyPercentage: 75
createdDate: 2022-05-19T20:05:32.720Z
createdBy: user1234
lastUpdate: 2022-05-20T21:13:07.410Z
lastUpdatedBy: user4321
PrivilegedResourceClaimAppAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: APP_ACCOUNT
containerDetails:
appName: "google,"
containerId: "0oa103099SBEb3Z2b0g4,"
displayName: "Google App1,"
globalAppId: "964b82aa-85b4-5645-b790-83312c473480,"
passwordPushSupported: "true,"
provisioningEnabled: "true,"
_links:
login:
href: "https://appinstance-admin.oktapreview.com/home/google/0oa103099SBEb3Z2b0g4,"
logo:
href: "https://appinstance-admin.oktapreview.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png,"
credentials:
userName: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: ACTIVE
credentialSyncInfo:
secretVersionId: ""
syncTime: ""
syncState: NOT_SYNCED
errorCode: ""
errorReason: ""
PrivilegedResourceClaimOktaAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: OKTA_USER_ACCOUNT
resourceId: "00u100xTfFs4MasRf0g4,"
credentials:
userName: username
profile:
email: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: ACTIVE
credentialSyncInfo:
secretVersionId: ""
syncTime: ""
syncState: NOT_SYNCED
errorCode: ""
errorReason: ""
PrivilegedResourceCreateAppAccountRequest:
value:
resourceType: APP_ACCOUNT
containerDetails:
containerId: 0oa103099SBEb3Z2b0g4
credentials:
userName: [email protected]
PrivilegedResourceCreateAppAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: APP_ACCOUNT
containerDetails:
appName: "google,"
containerId: "0oa103099SBEb3Z2b0g4,"
displayName: "Google App1,"
globalAppId: "964b82aa-85b4-5645-b790-83312c473480,"
passwordPushSupported: "true,"
provisioningEnabled: "true,"
_links:
login:
href: "https://appinstance-admin.oktapreview.com/home/google/0oa103099SBEb3Z2b0g4,"
logo:
href: "https://appinstance-admin.oktapreview.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png,"
credentials:
userName: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: INACTIVE
credentialSyncInfo:
secretVersionId: ""
syncTime: ""
syncState: NOT_SYNCED
errorCode: ""
errorReason: ""
PrivilegedResourceCreateOktaAccountRequestConvert:
value:
resourceType: OKTA_USER_ACCOUNT
resourceId: 00u100xTfFs4MasRf0g4
PrivilegedResourceCreateOktaAccountRequestNew:
value:
resourceType: OKTA_USER_ACCOUNT
credentials:
userName: username
profile:
email: [email protected]
PrivilegedResourceCreateOktaAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: OKTA_USER_ACCOUNT
resourceId: "00u100xTfFs4MasRf0g4,"
credentials:
userName: username
profile:
email: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: INACTIVE
credentialSyncInfo:
secretVersionId: ""
syncTime: ""
syncState: NOT_SYNCED
errorCode: ""
errorReason: ""
PrivilegedResourceRotatePasswordAppAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: APP_ACCOUNT
containerDetails:
appName: "google,"
containerId: "0oa103099SBEb3Z2b0g4,"
displayName: "Google App1,"
globalAppId: "964b82aa-85b4-5645-b790-83312c473480,"
passwordPushSupported: "true,"
provisioningEnabled: "true,"
_links:
login:
href: "https://appinstance-admin.oktapreview.com/home/google/0oa103099SBEb3Z2b0g4,"
logo:
href: "https://appinstance-admin.oktapreview.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png,"
credentials:
userName: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: ACTIVE
credentialSyncInfo:
secretVersionId: 9f8400-e29b-41d4-a716-926655440034
syncTime: ""
syncState: SYNCING
errorCode: ""
errorReason: ""
PrivilegedResourceRotatePasswordOktaAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: OKTA_USER_ACCOUNT
resourceId: "00u100xTfFs4MasRf0g4,"
credentials:
userName: username
profile:
email: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: ACTIVE
credentialSyncInfo:
secretVersionId: 9f8400-e29b-41d4-a716-926655440034
syncTime: 2024-06-11T11:11:01.000Z
syncState: SYNCED
errorCode: ""
errorReason: ""
PrivilegedResourcesAppAccountUpdateRequest:
value:
username: username
PrivilegedResourcesGetAppAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: APP_ACCOUNT
containerDetails:
appName: "google,"
containerId: "0oa103099SBEb3Z2b0g4,"
displayName: "Google App1,"
globalAppId: "964b82aa-85b4-5645-b790-83312c473480,"
passwordPushSupported: "true,"
provisioningEnabled: "true,"
_links:
login:
href: "https://appinstance-admin.oktapreview.com/home/google/0oa103099SBEb3Z2b0g4,"
logo:
href: "https://appinstance-admin.oktapreview.com/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png,"
credentials:
userName: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: ACTIVE
credentialSyncInfo:
secretVersionId: 9f8400-e29b-41d4-a716-926655440034
syncTime: 2024-06-10T11:30:01.000Z
syncState: SYNC_FAILED
errorCode: UNKNOWN_ERROR
errorReason: Password update failed
PrivilegedResourcesGetOktaAccountResponse:
value:
id: opa100xTfFs4MasRf0g4
resourceType: OKTA_USER_ACCOUNT
resourceId: "00u100xTfFs4MasRf0g4,"
credentials:
userName: [email protected]
profile:
email: [email protected]
created: 2024-06-10T11:11:01.000Z
lastUpdated: 2024-06-10T11:11:01.000Z
status: ACTIVE
credentialSyncInfo:
secretVersionId: 9f8400-e29b-41d4-a716-926655440034
syncTime: 2024-06-10T11:30:01.000Z
syncState: SYNCED
errorCode: ""
errorReason: ""
PrivilegedResourcesOktaUserAccountUpdateRequest:
value:
username: username
profile:
email: [email protected]
ProfileEnrollmentRequest:
summary: An example Profile Enrollment (SSR) inline hook request body
value:
eventId: 04Dmt8BcT_aEgM
eventTime: 2022-04-25T17:35:27.000Z
eventType: com.okta.user.pre-registration
eventTypeVersion: 1
contentType: application/json
cloudEventVersion: 0.1
source: regt4qeBKU29vSoPz0g3
requestType: self.service.registration
data:
context:
request:
method: POST
ipAddress: 127.0.0.1
id: 123testId456
url:
value: /idp/idx/enroll/new
userProfile:
firstName: Rosario
lastName: Jones
login: [email protected]
email: [email protected]
action: ALLOW
ProfileEnrollmentResponse:
summary: An example Profile Enrollment (SSR) inline hook response
value:
commands:
- type: com.action.update
value:
registration: ALLOW
ProfileEnrollmentResponseDeny:
summary: An example Profile Enrollment (SSR) inline hook Deny response
value:
commands:
- type: com.action.update
value:
registration: DENY
error:
errorSummary: Incorrect email address. Please contact your admin.
errorCauses:
- errorSummary: Only example.com emails can register.
reason: INVALID_EMAIL_DOMAIN
locationType: body
location: data.userProfile.email
domain: end-user
ProgressiveProfileRequest:
summary: An example Progressive Profile inline hook request
value:
eventId: vzYp_zMwQu2htIWRbNJdfw
eventTime: 2022-04-25T04:04:41.000Z
eventType: com.okta.user.pre-registration
eventTypeVersion: 1
contentType: application/json
cloudEventVersion: 0.1
source: regt4qeBKU29vS
requestType: progressive.profile
data:
context:
request:
method: POST
ipAddress: 127.0.0.1
id: 123dummyId456
url:
value: /idp/idx/enroll/update
user:
passwordChanged: 2022-01-01T00:00:00.000Z
_links:
groups:
href: /api/v1/users/00u48gwcu01WxvNol0g7/groups
factors:
href: /api/v1/users/00u48gwcu01WxvNol0g7/factors
profile:
firstName: Rosario
lastName: Jones"
timeZone: America/Los_Angeles
login: [email protected]
locale: en_US
id: 00u48gwcu01WxvNo
action: ALLOW
userProfileUpdate:
employeeNumber: 1234
ProgressiveProfileResponse:
summary: An example Progressive Profile inline hook response
value:
commands:
- type: com.okta.user.progressive.profile.update'
value: "request.body.data.userProfileUpdate['employeeNumber']"
ProgressiveProfileResponseDeny:
summary: An example Progressive Profile inline hook Deny response
value:
commands:
- type: com.action.update
value:
registration: DENY
error:
errorSummary: Incorrect employee number. Enter an employee number with 4
digits.
errorCauses:
- errorSummary: Only employee numbers with 4 digits can register.
reason: INVALID_EMPLOYEE_NUMBER
locationType: body
location: data.userProfile.employeeNumber
domain: end-user
ProvisioningConnectionOauthO365RequestEx:
summary: Provisioning Connection with OAuth 2.0 for Microsoft Office 365 app
value:
profile:
authScheme: OAUTH2
settings:
adminUsername: office_admin-username
adminPassword: office_admin-password
ProvisioningConnectionOauthRequestEx:
summary: Provisioning Connection with OAuth 2.0
value:
profile:
authScheme: OAUTH2
ProvisioningConnectionOauthResponseEx:
summary: Provisioning Connection with OAuth 2.0 for Microsoft Office 365 app
value:
status: ENABLED
profile:
authScheme: OAUTH2
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default"
hints:
allow:
- GET
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate"
hints:
allow:
- POST
authorize:
href: https://login.microsoftonline.com/myofficetenant.onmicrosoft.com/oauth2/authorize?response_type=code&state=>&client_id=&redirect_uri=&scope=
hints:
allow:
- GET
guidance:
- Specifies the URI to invoke in a browser for granting scope consent
required to complete the OAuth 2.0 connection.
ProvisioningConnectionTokenOrg2OrgRequestEx:
summary: Provisioning Connection with token for Okta Org2Org app
value:
profile:
authScheme: TOKEN
clientId: 0oa2h6su6bVFyJzIf1d7
ProvisioningConnectionTokenRequestEx:
summary: Provisioning Connection with token for Zscaler 2.0 (`zscalerbyz`) app
value:
baseUrl: https://scim.zscalerbeta.net/1234567/890/scim
profile:
authScheme: TOKEN
token: 00NgAPZqUVy8cX9ehNzzahEE5b-On9sImTcInvWp-x
ProvisioningConnectionTokenResponseWithProfileOrg2OrgEx:
summary: Provisioning Connection with token for Okta Org2Org (`okta_org2org`)
app
value:
authScheme: TOKEN
status: ENABLED
baseUrl: https://targetorg.okta.com
profile:
authScheme: TOKEN
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default"
hints:
allow:
- GET
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate"
hints:
allow:
- POST
ProvisioningConnectionTokenResponseWithProfileZscalerEx:
summary: Provisioning Connection with token for Zscaler 2.0 (`zscalerbyz`) app
value:
authScheme: TOKEN
status: ENABLED
baseUrl: https://scim.zscalerbeta.net/1234567/890/scim
profile:
authScheme: TOKEN
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default"
hints:
allow:
- GET
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/connections/default/lifecycle/deactivate"
hints:
allow:
- POST
PushProviderAPNsRequest:
value:
name: APNs Example
providerType: APNS
configuration:
keyId: KEY_ID
teamId: TEAM_ID
tokenSigningKey: '-----BEGIN PRIVATE KEY-----\nPRIVATE_KEY\n-----END PRIVATE
KEY-----\n'
fileName: fileName.p8
PushProviderAPNsResponse:
value:
id: ppctekcmngGaqeiBxB0g4
name: APNs Example
providerType: APNS
lastUpdatedDate: 2022-01-01T00:00:00.000Z
configuration:
keyId: KEY_ID
teamId: TEAM_ID
fileName: fileName.p8
_links:
self:
href: https://your-subdomain.okta.com/api/v1/push-providers/ppctekcmngGaqeiBxB0g4
hints:
allow:
- DELETE
- GET
- PUT
PushProviderFCMRequest:
value:
name: FCM Example
providerType: FCM
configuration:
serviceAccountJson:
type: service_account
project_id: PROJECT_ID
private_key_id: KEY_ID
private_key: '-----BEGIN PRIVATE KEY-----\nPRIVATE_KEY\n-----END PRIVATE
KEY-----\n'
client_email: SERVICE_ACCOUNT_EMAIL
client_id: CLIENT_ID
auth_uri: https://accounts.google.com/o/oauth2/auth
token_uri: https://accounts.google.com/o/oauth2/token
auth_provider_x509_cert_url: https://www.googleapis.com/oauth2/v1/certs
client_x509_cert_url: https://www.googleapis.com/robot/v1/metadata/x509/SERVICE_ACCOUNT_EMAIL
fileName: fileName.json
PushProviderFCMResponse:
value:
id: ppctekcmngGaqeiBxB0g4
name: FCM Example
providerType: FCM
lastUpdatedDate: 2022-01-01T00:00:00.000Z
configuration:
projectId: PROJECT_ID
fileName: fileName.p8
_links:
self:
href: https://your-subdomain.okta.com/api/v1/push-providers/ppctekcmngGaqeiBxB0g4
hints:
allow:
- DELETE
- GET
- PUT
RateLimitAdminNotificationsDisabled:
value:
notificationsEnabled: false
RateLimitAdminNotificationsEnabled:
value:
notificationsEnabled: true
RateLimitWarningThresholdValidExample:
value:
warningThreshold: 66
RealmResponse:
value:
id: guox9jQ16k9V8IFEL0g3
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
isDefault: false
profile:
name: Car Co
_links:
self:
rel: self
href: http://your-subdomain.okta.com/api/v1/realms/guox9jQ16k9V8IFEL0g3
method: GET
RefreshCurrentSessionResponse:
summary: Refresh current session
value:
amr:
- pwd
createdAt: 2019-08-24T14:15:22Z
expiresAt: 2019-08-24T14:15:22Z
id: l7FbDVqS8zHSy65uJD85
idp:
id: 01a2bcdef3GHIJKLMNOP
type: ACTIVE_DIRECTORY
lastFactorVerification: 2019-08-24T14:15:22Z
lastPasswordVerification: 2019-08-24T14:15:22Z
login: [email protected]
status: ACTIVE
userId: 00u0abcdefGHIJKLMNOP
_links:
self:
hints:
allow:
- GET
- DELETE
href: "https://{yourOktaDomain}/api/v1/sessions/me"
refresh:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/sessions/me/lifecycle/refresh"
user:
hints:
allow:
- GET
href: "https://{yourOktaDomain}/api/v1/users/me"
name: User Name
RefreshSessionResponse:
summary: Refresh an existing Session using the session ID
value:
amr:
- pwd
createdAt: 2019-08-25T14:17:22Z
expiresAt: 2019-08-25T14:17:22Z
id: l7FbDVqS8zHSy65uJD85
idp:
id: 01a2bcdef3GHIJKLMNOP
type: ACTIVE_DIRECTORY
lastFactorVerification: 2019-08-24T14:15:22Z
lastPasswordVerification: 2019-08-24T14:15:22Z
login: [email protected]
status: ACTIVE
userId: 00u0abcdefGHIJKLMNOP
_links:
self:
hints:
allow:
- DELETE
href: "https://{yourOktaDomain}/api/v1/sessions/l7FbDVqS8zHSy65uJD85"
RemoveMappingBody:
summary: Update an existing profile mapping by removing one or more properties
value:
properties:
nickName:
expression: null
pushStatus: null
RemoveMappingResponse:
summary: Update an existing profile mapping by removing one or more properties
value:
id: prm1k47ghydIQOTBW0g4
source:
id: otysbePhQ3yqt4cVv0g3
name: user
type: user
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/types/user/otysbePhQ3yqt4cVv0g3"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscsbePhQ3yqt4cVv0g3"
target:
id: 0oa1qmn4LZQQEH0wZ0g4
name: okta_org2org
type: appuser
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1qmn4LZQQEH0wZ0g4"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/apps/0oa1qmn4LZQQEH0wZ0g4/default"
properties:
fullName:
expression: user.firstName + user.lastName
pushStatus: PUSH
_links:
self:
href: "https://{yourOktaDomain}/api/v1/mappings/prm1k48weFSOnEUnw0g4"
ReplaceAnEventHookWithFilter:
summary: Replace an event hook
value:
name: Event Hook with Filter
description: An event hook using an Okta Expression Language filter
events:
type: EVENT_TYPE
items:
- group.user_membership.add
filter:
type: EXPRESSION_LANGUAGE
eventFilterMap:
- event: group.user_membership.add
condition:
expression: "event.target.?[type eq 'UserGroup'].size()>0 && event.target.?[displayName\
\ eq 'Sales'].size()>0"
channel:
type: HTTP
version: 1.0.0
config:
uri: https://example_external_service/userAdded
authScheme:
type: HEADER
key: Authorization
value: my-shared-secret
ReplaceAuthServerBody:
summary: Replace a custom authorization server
value:
name: New Authorization Server
description: Authorization Server description
audiences:
- api://default
credentials:
signing:
rotationMode: AUTO
use: sig
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
issuerMode: ORG_URL
status: ACTIVE
ReplaceAuthServerResponse:
summary: Replace a custom authorization server
value:
id: "{authorizationServerId}"
name: Sample Authorization Server
description: Sample Authorization Server description
audiences:
- https://api.resource.com
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
issuerMode: ORG_URL
status: ACTIVE
created: 2023-05-17T22:25:57.000Z
lastUpdated: 2023-05-17T22:25:57.000Z
credentials:
signing:
rotationMode: AUTO
lastRotated: 2023-05-17T22:25:57.000Z
nextRotation: 2023-08-15T22:25:57.000Z
kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4
_links:
scopes:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes"
hints:
allow:
- GET
claims:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims"
hints:
allow:
- GET
policies:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies"
hints:
allow:
- GET
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}"
hints:
allow:
- GET
- DELETE
- PUT
metadata:
- name: oauth-authorization-server
href: "https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server"
hints:
allow:
- GET
- name: openid-configuration
href: "https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration"
hints:
allow:
- GET
rotateKey:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate"
hints:
allow:
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate"
hints:
allow:
- POST
ReplaceCustomTokenClaimBody:
summary: Replace a custom token Claim
value:
- alwaysIncludeInToken: true
claimType: IDENTITY
conditions:
scopes:
- profile
group_filter_type: CONTAINS
name: Knowledge_Base
status: ACTIVE
system: false
value: Knowledge Base
valueType: GROUPS
ReplaceCustomTokenClaimResponse:
summary: Replace a custom token Claim response
value:
- id: "{claimId}"
name: Knowledge_Base
status: ACTIVE
claimType: IDENTITY
valueType: GROUPS
value: Knowledge Base
conditions:
scopes:
- profile
system: false
alwaysIncludeInToken: true
apiResourceId: null
group_filter_type: CONTAINS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId}"
hints:
allow:
- GET
- PUT
- DELETE
ReplaceIdPRequestResponse:
summary: Replace an Identity Provider
value:
id: 0oa62bc8wppPw0UGr0h7
type: SAML2
name: Example SAML IdP
status: INACTIVE
created: null
lastUpdated: 2016-03-29T21:23:45.000Z
protocol:
type: SAML2
endpoints:
sso:
url: https://idp.example.com/saml2/sso
binding: HTTP-REDIRECT
destination: https://idp.example.com/saml2/sso
acs:
binding: HTTP-POST
type: INSTANCE
algorithms:
request:
signature:
algorithm: SHA-256
scope: REQUEST
response:
signature:
algorithm: SHA-256
scope: ANY
settings:
nameFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
credentials:
trust:
issuer: https://idp.example.com
audience: https://www.okta.com/saml2/service-provider/spCQJRNaaxs7ANqKBO7M
kid: your-key-id
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: idpuser.subjectNameId
filter: null
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 120000
_links:
metadata:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml"
type: application/xml
hints:
allow:
- GET
acs:
href: "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7"
type: application/xml
hints:
allow:
- POST
users:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users"
hints:
allow:
- GET
activate:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/activate"
hints:
allow:
- POST
ReplaceKeyResponse:
summary: Replace a key response example
value:
id: HKY1p7jWLndGQV9M60g4
keyId: 7fbc27fd-e3df-4522-86bf-1930110256ad
name: My updated new key
created: 2022-08-31T18:09:58.000Z
lastUpdated: 2022-08-31T18:16:59.000Z
isUsed: "false"
ReplaceNetworkZone:
summary: Replace a Network Zone
value:
type: IP
id: nzovw2rFz2YoqmvwZ0g9
name: UpdatedNetZone
status: ACTIVE
system: false
usage: POLICY
gateways:
- type: CIDR
value: 10.2.3.4/24
- type: CIDR
value: 12.2.3.4/24
- type: RANGE
value: 13.4.5.6-13.4.5.8
- type: CIDR
value: 14.2.3.4/24
proxies:
- type: CIDR
value: 12.2.3.4/24
- type: CIDR
value: 13.3.4.5/24
- type: RANGE
value: 14.4.5.6-14.4.5.8
- type: RANGE
value: 15.5.6.7/24-15.5.6.9
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzovw2rFz2YoqmvwZ0g9"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzovw2rFz2YoqmvwZ0g9/lifecycle/deactivate"
hints:
allow:
- POST
ReplaceNetworkZoneResponse:
summary: Replace Network Zone
value:
type: IP
id: nzovw2rFz2YoqmvwZ0g9
name: UpdatedNetZone
status: ACTIVE
usage: POLICY
created: 2022-05-08T18:25:05.000Z
lastUpdated: 2022-05-10T13:15:22.000Z
system: false
gateways:
- type: CIDR
value: 10.2.3.4/24
- type: CIDR
value: 12.2.3.4/24
- type: RANGE
value: 13.4.5.6-13.4.5.8
- type: CIDR
value: 14.2.3.4/24
proxies:
- type: CIDR
value: 12.2.3.4/24
- type: CIDR
value: 13.3.4.5/24
- type: RANGE
value: 14.4.5.6-14.4.5.8
- type: RANGE
value: 15.5.6.7/24-15.5.6.9
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzovw2rFz2YoqmvwZ0g9"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzovw2rFz2YoqmvwZ0g9/lifecycle/deactivate"
hints:
allow:
- POST
ReplaceResourceSetRequest:
value:
label: SF-IT-People
description: People in the IT department of San Francisco
ReplaceRoleRequest:
value:
label: UserCreator
description: Create users
ReplaceUserTypePutRequest:
summary: Replace user type request
value:
displayName: Replacement Display Name
description: Replacement description
name: newUserType
ReplaceUserTypePutResponse:
summary: Replace user type response
value:
id: otyfnly5cQjJT9PnR0g4
displayName: Replacement Display Name
name: newUserType
description: Replacement description
createdBy: sprz9fj1ycBcsgopy1d6
lastUpdatedBy: sprz9fj1ycBcsgopy1d6
created: 2021-07-05T20:40:38.000Z
lastUpdated: 2021-07-05T20:40:38.000Z
default: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
ResetPwdWithoutSendingEmailResponse:
value:
summary: Reset password without sending email
resetPasswordUrl: "https://{yourOktaDomain}/reset_password/XE6wE17zmphl3KqAPFxO"
ResourceSelectorCreateRequestExample:
value:
name: All applications except Workday applications
description: All applications except Workday applications
schema: /api/v1/apps
filter: name ne "workday"
ResourceSelectorCreateResponseExample:
value:
id: rsl1hx31gVEa6x10v0g5
name: All applications except Workday applications
description: All applications except Workday applications
orn: orn:okta:idp:00o5rb5mt2H3d1TJd0h7:resource_selectors:rsl1hx31gVEa6x10v0g5:apps
_links:
self:
href: "https://{yourOktaDomain}/api/v1/resource-selectors/rsl1hx31gVEa6x10v0g5"
resources:
href: "https://{yourOktaDomain}/api/v1/apps?filter=\"name ne \"workday\"\
\""
ResourceSelectorPatchRequestExample:
value:
name: All applications except Facebook applications
description: All applications except Facebook applications
filter: name ne "facebook"
ResourceSelectorPatchResponseExample:
value:
id: rsl1hx31gVEa6x10v0g5
name: All applications except Facebook applications
description: All applications except Facebook applications
orn: orn:okta:idp:00o5rb5mt2H3d1TJd0h7:resource_selectors:rsl1hx31gVEa6x10v0g5:apps
_links:
self:
href: "https://{yourOktaDomain}/api/v1/resource-selectors/rsl1hx31gVEa6x10v0g5"
resources:
href: "https://{yourOktaDomain}/api/v1/apps?filter=\"name ne \"facebook\"\
\""
ResourceSelectorResponseExample:
value:
id: rsl1hx31gVEa6x10v0g5
name: All applications except a specific application
description: All applications except a specific application
orn: orn:okta:idp:00o5rb5mt2H3d1TJd0h7:resource_selectors:rsl1hx31gVEa6x10v0g5:apps
_links:
self:
href: "https://{yourOktaDomain}/api/v1/resource-selectors/rsl1hx31gVEa6x10v0g5"
resources:
href: "https://{yourOktaDomain}/api/v1/apps?filter=\"id ne 0oafxqAAJWWGELFTYASH\""
ResourceSelectorsResponseExample:
value:
resourceSelectors:
- id: rsl1hx31gVEa6x10v0g5
name: All applications except Workday applications
description: All applications except Workday applications
orn: orn:okta:idp:00o5rb5mt2H3d1TJd0h7:resource_selectors:rsl1hx31gVEa6x10v0g5:apps
_links:
resources:
href: "http://${yourOktaDomain}/api/v1/apps?filter=\"id ne 0oafxqCAJWWGELFTYASJ\""
- id: rsl1hx31gVEa6x10v0g6
name: All applications except Facebook applications
description: All applications except Facebook applications
orn: orn:okta:idp:00o5rb5mt2H3d1TJd0h7:resource_selectors:rsl1hx31gVEa6x10v0g6:apps
_links:
resources:
href: "http://${yourOktaDomain}/api/v1/apps?filter=\"id ne 0oafxqAAJWWGELFTYASH"
_links:
next:
href: "https://{yourOktaDomain}/api/v1/resource-selectors?after=rsl1hx31gVEa6x10v0g6"
ResourceSetBindingAddMembersRequestExample:
value:
additions:
- "https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3"
- "https://{yourOktaDomain}/api/v1/users/00u67DU2qNCjNZYO0g3"
ResourceSetBindingCreateRequestExample:
value:
role: cr0Yq6IJxGIr0ouum0g3
members:
- "https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3"
ResourceSetBindingMemberResponse:
value:
id: irb1qe6PGuMc7Oh8N0g4
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00uuk41Hjga5qGfQ30g3"
ResourceSetBindingMembersResponse:
value:
members:
- id: irb1qe6PGuMc7Oh8N0g4
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00uuk41Hjga5qGfQ30g3"
- id: irb1q92TFAHzySt3x0g4
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3"
_links:
binding:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3"
next:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members?after=0ouRq6IJmGIr3ouum0g3"
ResourceSetBindingResponseExample:
value:
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3"
bindings:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
ResourceSetBindingResponseWithIdExample:
value:
id: cr0Yq6IJxGIr0ouum0g3
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3"
bindings:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
ResourceSetBindingsResponse:
value:
roles:
- id: cr0WxyzJxGIr0ouum0g4
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0WxyzJxGIr0ouum0g4"
members:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0WxyzJxGIr0ouum0g4/members"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
next:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings?after=cr0WxyzJxGIr0ouum0g4"
ResourceSetRequest:
value:
label: SF-IT-People
description: People in the IT department of San Francisco
resources:
- "https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3"
- "https://{yourOktaDomain}/api/v1/groups/00gu67DU2qNCjNZYO0g3/users"
- "https://{yourOktaDomain}/api/v1/users"
ResourceSetResourcePatchRequestExample:
value:
additions:
- "https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3"
- "https://{yourOktaDomain}/api/v1/groups/00gu67DU2qNCjNZYO0g3/users"
ResourceSetResourcePostRequestExample:
summary: Resource Set with conditions request
value:
resourceOrnOrUrl: "https://{yourOktaDomain}/api/v1/apps"
conditions:
Exclude:
okta:ORN:
- orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps:0oa1014FmyZ2H0oRY0g4
- orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps:slack
ResourceSetResourcePutRequestExample:
value:
conditions:
Exclude:
okta:ORN:
- orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps:0oa1014FmyZ2H0oRY0g4
- orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps:slack
ResourceSetResourceResponse:
summary: Resource Set response
value:
id: ire106sQKoHoXXsAe0g4
orn: orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps
conditions:
Exclude:
okta:ORN:
- orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps:0oa1014FmyZ2H0oRY0g4
- orn:okta:idp:00o5rb5mt2H3d1TJd0h7:apps:slack
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps"
resource:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g1"
ResourceSetResourcesResponse:
value:
resources:
- id: ire106sQKoHoXXsAe0g4
orn: "orn:{partition}:directory:{yourOrgId}:groups:00guaxWZ0AOa5NFAj0g3"
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/groups/00guaxWZ0AOa5NFAj0g3"
resource:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g1"
- id: ire106riDrTYl4qA70g4
orn: "orn:{partition}:directory:{yourOrgId}:groups:00gu67DU2qNCjNZYO0g3:contained_resources"
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/groups/00gu67DU2qNCjNZYO0g3/users"
resource:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g2"
- id: irezvo4AwE2ngpMw40g3
orn: "orn:{partition}:directory:{yourOrgId}:users"
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users"
users:
href: "https://{yourOktaDomain}/api/v1/users"
- id: ire2j4iDnxHhUFaZN0g4
orn: "orn:{partition}:directory:{yourOrgId}:groups"
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/groups"
groups:
href: "https://{yourOktaDomain}/api/v1/groups"
resource:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources/ire2snv2xSY7a4iSe0g3"
_links:
next:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources?after=irezvn1ZZxLSIBM2J0g3"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
ResourceSetResponse:
value:
id: iamoJDFKaJxGIr0oamd9g
label: SF-IT-People
description: People in the IT department of San Francisco
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
resources:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources"
bindings:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings"
ResourceSetsResponse:
value:
resource-sets:
- id: iamoJDFKaJxGIr0oamd9g
label: SF-IT-1
description: First San Francisco IT Resource Set
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
resources:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/resources"
bindings:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings"
- id: iamoJDFKaJxGIr0oamd0q
label: SF-IT-2
description: Second San Francisco IT Resource Set
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q"
resources:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q/resources"
bindings:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd0q/bindings"
_links:
next:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets?after=iamoJDFKaJxGIr0oamd0q"
RetrieveADeactivatedEventHook:
summary: Deactivated event hook
value:
id: who8vt36qfNpCGz9H1e6
status: INACTIVE
verificationStatus: VERIFIED
name: Event Hook Test
description: null
created: 2023-07-07T13:41:56.000Z
createdBy: 00u7xut94qEWYx5ss1e5
lastUpdated: 2023-07-07T13:43:03.000Z
events:
type: EVENT_TYPE
items:
- group.user_membership.add
filter: null
channel:
type: HTTP
version: 1.0.0
config:
uri: https://example_external_service/userAdded
headers:
- key: X-Other-Header
value: my-header-value
method: POST
authScheme:
type: HEADER
key: authorization
_links:
self:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6
verify:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/verify
hints:
allow:
- POST
deactivate:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/deactivate
hints:
allow:
- POST
RetrieveAllEventHooks:
summary: Retrieves all event hooks
value:
- id: who8tsqyrhCdmetzx135
status: ACTIVE
verificationStatus: VERIFIED
name: Event Hook Test
description: null
created: 2023-07-07T17:41:56.000Z
createdBy: 00u7xut94qEWYx5ss1e5
lastUpdated: 2023-07-07T17:43:03.000Z
events:
type: EVENT_TYPE
items:
- user.lifecycle.deactivate
- user.lifecycle.activate
filter: null
channel:
type: HTTP
version: 1.0.0
config:
uri: https://example_external_service/userDeactivate
headers: []
method: POST
authScheme:
type: HEADER
key: authorization
_links:
self:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx135
verify:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx135/lifecycle/verify
hints:
allow:
- POST
deactivate:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx135/lifecycle/deactivate
hints:
allow:
- POST
- id: who8vt36qfNpCGz9H1e6
status: ACTIVE
verificationStatus: VERIFIED
name: Event Hook with Filter
description: An event hook using an Okta Expression Language filter
created: 2023-07-07T13:41:56.000Z
createdBy: 00u7xut94qEWYx5ss1e5
lastUpdated: 2023-07-07T13:43:03.000Z
events:
type: EVENT_TYPE
items:
- group.user_membership.add
filter:
type: EXPRESSION_LANGUAGE
eventFilterMap:
- event: group.user_membership.add
condition:
version: null
expression: "event.target.?[type eq 'UserGroup'].size()>0 && event.target.?[displayName\
\ eq 'Sales'].size()>0"
channel:
type: HTTP
version: 1.0.0
config:
uri: https://example_external_service/userAdded
headers: []
method: POST
authScheme:
type: HEADER
key: authorization
_links:
self:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6
verify:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/verify
hints:
allow:
- POST
deactivate:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/deactivate
hints:
allow:
- POST
RetrieveAllZones:
summary: Retrieves all Network Zones
value:
- type: DYNAMIC_V2
id: nzok0oz2xYHOZtIch0g4
name: testZone106
status: ACTIVE
usage: BLOCKLIST
create: 2024-05-13T16:33:44.000Z
lastUpdated: 2024-05-13T16:33:44.000Z
system: false
locations:
include: []
exclude: []
asns:
include: []
exclude: []
ipServiceCategories:
include:
- ALL_ANONYMIZERS
exclude: []
_links:
self:
href: "http://{yourOktaDomain}/api/v1/zones/nzok0oz2xYHOZtIch0g4"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "http://{yourOktaDomain}/api/v1/zones/nzok0oz2xYHOZtIch0g4/lifecycle/deactivate"
hints:
allow:
- POST
- type: DYNAMIC
id: nzoy0ox5xADOZtKrh0g6
name: test
status: ACTIVE
usage: POLICY
created: 2022-05-19T15:33:32.000Z
lastUpdated: 2022-05-19T15:33:32.000Z
system: false
locations:
- country: AF
region: AF-BGL
proxyType: ANY
asns:
- "23457"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzoy0ox5xADOZtKrh0g6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzoy0ox5xADOZtKrh0g6/lifecycle/deactivate"
hints:
allow:
- POST
- type: IP
id: nzowc1U5Jh5xuAK0o0g3
name: MyIpZone
status: ACTIVE
usage: POLICY
created: 2021-06-24T20:37:32.000Z
lastUpdated: 2021-06-24T20:37:32.000Z
system: false
gateways:
- type: CIDR
value: 1.2.3.4/24
proxies:
- type: RANGE
value: 3.3.4.5-3.3.4.15
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3/lifecycle/deactivate"
hints:
allow:
- POST
- type: IP
id: nzou3u0stMCmgOzXK1d6
name: BlockedIpZone
status: ACTIVE
usage: BLOCKLIST
created: 2021-06-09T21:32:46.000Z
lastUpdated: 2021-06-09T21:32:46.000Z
system: true
gateways: null
proxies: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6/lifecycle/deactivate"
hints:
allow:
- POST
- type: DYNAMIC_V2
id: nzohcnxFrSgsiwyHp0g4
name: DefaultEnhancedDynamicZone
status: ACTIVE
usage: BLOCKLIST
created: 2024-05-06T19:12:29.000Z
lastUpdated: 2024-05-09T21:02:31.000Z
system: true
locations:
include: []
exclude: []
ipServiceCategories:
include:
- ALL_ANONYMIZERS
exclue: []
asns:
include: []
exclude: []
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0stMCmgOzXK1d6/lifecycle/deactivate"
hints:
allow:
- POST
- type: IP
id: nzou3u0ssJfZjYsWL1d6
name: LegacyIpZone
status: ACTIVE
usage: POLICY
created: 2021-06-09T21:32:46.000Z
lastUpdated: 2021-06-09T21:32:46.000Z
system: true
gateways: null
proxies: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0ssJfZjYsWL1d6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzou3u0ssJfZjYsWL1d6/lifecycle/deactivate"
hints:
allow:
- POST
RetrieveAllZonesWithFilter:
summary: Retrieves Network Zones with filter
value:
- type: IP
id: nzowc1U5Jh5xuAK0o0g3
name: MyIpZone
status: ACTIVE
usage: POLICY
created: 2021-06-24T20:37:32.000Z
lastUpdated: 2021-06-24T20:37:32.000Z
system: false
gateways:
- type: CIDR
value: 1.2.3.4/24
proxies:
- type: RANGE
value: 3.3.4.5-3.3.4.15
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3/lifecycle/deactivate"
hints:
allow:
- POST
RetrieveAnEventHook:
summary: Retrieve an event hook
value:
id: who8vt36qfNpCGz9H1e6
status: ACTIVE
verificationStatus: VERIFIED
name: Event Hook Test
description: null
created: 2023-07-07T13:41:56.000Z
createdBy: 00u7xut94qEWYx5ss1e5
lastUpdated: 2023-07-07T13:43:03.000Z
events:
type: EVENT_TYPE
items:
- group.user_membership.add
filter: null
channel:
type: HTTP
version: 1.0.0
config:
uri: https://example_external_service/userAdded
headers:
- key: X-Other-Header
value: my-header-value
method: POST
authScheme:
type: HEADER
key: authorization
_links:
self:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6
verify:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/verify
hints:
allow:
- POST
deactivate:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/deactivate
hints:
allow:
- POST
RetrieveAnEventHookWithFilter:
summary: Retrieve an event hook
value:
id: who8vt36qfNpCGz9H1e6
status: ACTIVE
verificationStatus: VERIFIED
name: Event Hook with Filter
description: An event hook using an Okta Expression Language filter
created: 2023-07-07T13:41:56.000Z
createdBy: 00u7xut94qEWYx5ss1e5
lastUpdated: 2023-07-07T13:43:03.000Z
events:
type: EVENT_TYPE
items:
- group.user_membership.add
filter:
type: EXPRESSION_LANGUAGE
eventFilterMap:
- event: group.user_membership.add
condition:
version: null
expression: "event.target.?[type eq 'UserGroup'].size()>0 && event.target.?[displayName\
\ eq 'Sales'].size()>0"
channel:
type: HTTP
version: 1.0.0
config:
uri: https://example_external_service/userAdded
method: POST
authScheme:
type: HEADER
key: authorization
_links:
self:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6
verify:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/verify
hints:
allow:
- POST
deactivate:
href: https://example.com/api/v1/eventHooks/who8tsqyrhCdmetzx1e6/lifecycle/deactivate
hints:
allow:
- POST
RetrieveAuthServerResponse:
summary: Retrieve a custom authorization server
value:
id: "{authorizationServerId}"
name: Sample Authorization Server
description: Sample Authorization Server description
audiences:
- https://api.resource.com
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
issuerMode: ORG_URL
status: ACTIVE
created: 2023-05-17T22:25:57.000Z
lastUpdated: 2023-05-17T22:25:57.000Z
credentials:
signing:
rotationMode: AUTO
lastRotated: 2023-05-17T22:25:57.000Z
nextRotation: 2023-08-15T22:25:57.000Z
kid: WYQxoK4XAwGFn5Zw5AzLxFvqEKLP79BbsKmWeuc5TB4
_links:
scopes:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes"
hints:
allow:
- GET
claims:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims"
hints:
allow:
- GET
policies:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/policies"
hints:
allow:
- GET
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}"
hints:
allow:
- GET
- DELETE
- PUT
metadata:
- name: oauth-authorization-server
href: "https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/oauth-authorization-server"
hints:
allow:
- GET
- name: openid-configuration
href: "https://{yourOktaDomain}/oauth2/{authorizationServerId}/.well-known/openid-configuration"
hints:
allow:
- GET
rotateKey:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/credentials/lifecycle/keyRotate"
hints:
allow:
- POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/lifecycle/deactivate"
hints:
allow:
- POST
RetrieveCurrentSessionResponse:
summary: Retrieve current session
value:
amr:
- pwd
createdAt: 2019-08-24T14:15:22Z
expiresAt: 2019-08-24T14:15:22Z
id: l7FbDVqS8zHSy65uJD85
idp:
id: 01a2bcdef3GHIJKLMNOP
type: ACTIVE_DIRECTORY
lastFactorVerification: 2019-08-24T14:15:22Z
lastPasswordVerification: 2019-08-24T14:15:22Z
login: [email protected]
status: ACTIVE
userId: 00u0abcdefGHIJKLMNOP
_links:
self:
hints:
allow:
- GET
- DELETE
href: "https://{yourOktaDomain}/api/v1/sessions/me"
refresh:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/sessions/me/lifecycle/refresh"
user:
hints:
allow:
- GET
href: "https://{yourOktaDomain}/api/v1/users/me"
name: User Name
RetrieveCustomTokenClaimResponse:
summary: Retrieve a custom token Claim response
value:
- id: "{claimId}"
name: Support
status: ACTIVE
claimType: IDENTITY
valueType: GROUPS
value: Support
conditions:
scopes:
- profile
system: false
alwaysIncludeInToken: true
apiResourceId: null
group_filter_type: CONTAINS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/claims/{claimId}"
hints:
allow:
- GET
- PUT
- DELETE
RetrieveFeaturesResponse:
summary: Retrieve a feature by ID
value:
id: ftrZooGoT8b41iWRiQs7
description: Example feature description
name: Example feature name
stage:
state: CLOSED
value: BETA
status: DISABLED
type: self-service
_links:
self:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/features/ftrZooGoT8b41iWRiQs7"
dependents:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependents"
dependencies:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependencies"
RetrieveKeyResponse:
summary: Retrieve a key by id response example
value:
id: HKY1p7jWLndGQV9M60g4
keyId: 7fbc27fd-e3df-4522-86bf-1930110256ad
name: My new key
created: 2022-08-31T18:09:58.000Z
lastUpdated: 2022-08-31T18:09:58.000Z
isUsed: "false"
RetrieveMappingsResponse:
summary: Retrieve a single Profile Mapping
value:
id: prm1k47ghydIQOTBW0g4
source:
id: otysbePhQ3yqt4cVv0g3
name: user
type: user
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/types/user/otysbePhQ3yqt4cVv0g3"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscsbePhQ3yqt4cVv0g3"
target:
id: 0oa1qmn4LZQQEH0wZ0g4
name: okta_org2org
type: appuser
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1qmn4LZQQEH0wZ0g4"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/apps/0oa1qmn4LZQQEH0wZ0g4/default"
properties:
firstName:
expression: user.firstName
pushStatus: PUSH
lastName:
expression: user.lastName
pushStatus: PUSH
_links:
self:
href: "https://{yourOktaDomain}/api/v1/mappings/prm1k48weFSOnEUnw0g4"
RetrieveNetworkZoneDynamic:
summary: Dynamic Network Zone
value:
type: DYNAMIC
id: nzoy0ox5xADOZtKrh0g6
name: test
status: ACTIVE
usage: POLICY
created: 2022-05-19T15:33:32.000Z
lastUpdated: 2022-05-19T15:33:32.000Z
system: false
locations:
- country: AF
region: AF-BGL
proxyType: ANY
asns:
- "23457"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzoy0ox5xADOZtKrh0g6"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzoy0ox5xADOZtKrh0g6/lifecycle/deactivate"
hints:
allow:
- POST
RetrieveNetworkZoneIP:
summary: IP Network Zone
value:
type: IP
id: nzowc1U5Jh5xuAK0o0g3
name: MyIpZone
status: ACTIVE
usage: POLICY
created: 2021-06-24T20:37:32.000Z
lastUpdated: 2021-06-24T20:37:32.000Z
system: false
gateways:
- type: CIDR
value: 1.2.3.4/24
proxies:
- type: RANGE
value: 3.3.4.5-3.3.4.15
_links:
self:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/zones/nzowc1U5Jh5xuAK0o0g3/lifecycle/deactivate"
hints:
allow:
- POST
RetrievePublicKeyResponse:
summary: Retrieve Public Key response example
value:
_embedded:
kty: RSA
alg: RSA
kid: 7fbc27fd-e3df-4522-86bf-1930110256ad
use: null
e: AQAB
"n": 2naqCnv6r4xNQs7207lRtKQvdtnlVND-8k5iYBIiqoKGY3CqUmRm1jleoOniiQoMkFX8Wj2DmVqr002efF3vOQ7_gjtTatBTVUNbNIQLybun4dkVoUtfP7pRc5SLpcP3eGPRVar734ZrpQXzmCEdpqBt3jrVjwYjNE5DqOjbYXFJtMsy8CWE9LRJ3kyHEoHPzo22dG_vMrXH0_sAQoCk_4TgNCbvyzVmGVYXI_BkUnp0hv2pR4bQVRYzGB9dKJdctOh8zULqc_EJ8tiYsS05YnF7whrWEyARK0rH-e4d4W-OmBTga_zhY4kJ4NsoQ4PyvcatZkxjPO92QHQOFDnf3w`
RetrieveRefreshTokenClientResponse:
summary: Retrieve a refresh token for a Client
value:
- id: "{refreshTokenId}"
status: ACTIVE
created: 2023-09-21T19:59:56.000Z
lastUpdated: 2023-09-21T20:00:38.000Z
expiresAt: 2023-09-28T20:00:38.000Z
issuer: "https://{yourOktaDomain}/oauth2/{authorizationServerId}"
client_id: "{clientId}"
userId: "{userId}"
scopes:
- offline_access
- openid
_embedded:
scopes:
- id: "{scopeID}"
name: offline_access
displayName: Keep you signed in to the app
description: "This keeps you signed in to the app, even when you aren't\
\ using it."
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}"
title: Keep you signed in to the app
- id: "{scopeId}"
name: openid
displayName: openid
description: Signals that a request is an OpenID request
_links:
scope:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/{scopeId}"
title: openid
_links:
app:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}"
title: My Web App
authorizationServer:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}"
title: Authorization Server name
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}"
revoke:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/clients/{clientId}/tokens/{tokenId}"
hints:
allow:
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/{clientId}"
title: My Web App
user:
href: "https://{yourOktaDomain}/api/v1/users/{userId}"
title: Joe User
RetrieveSessionResponse:
summary: Retrieve Session information for a single session ID
value:
amr:
- pwd
createdAt: 2019-08-24T14:15:22Z
expiresAt: 2019-08-24T14:15:22Z
id: l7FbDVqS8zHSy65uJD85
idp:
id: 01a2bcdef3GHIJKLMNOP
type: ACTIVE_DIRECTORY
lastFactorVerification: 2019-08-24T14:15:22Z
lastPasswordVerification: 2019-08-24T14:15:22Z
login: [email protected]
status: ACTIVE
userId: 00u0abcdefGHIJKLMNOP
_links:
self:
hints:
allow:
- DELETE
href: "https://{yourOktaDomain}/api/v1/sessions/l7FbDVqS8zHSy65uJD85"
RetrieveUISchemaResponse:
summary: Retrieves a UI Schema response
value:
id: uis4a7liocgcRgcxZ0g7
uiSchema:
type: Group
label: Sign in
buttonLabel: Submit
elements:
- type: Control
scope: '#/properties/firstName'
label: First name
options:
format: text
- type: Control
scope: '#/properties/lastName'
label: Last name
options:
format: text
- type: Control
scope: '#/properties/email'
label: Email
options:
format: text
- type: Control
scope: '#/properties/countryCode'
label: Country code
options:
format: select
- type: Control
scope: '#/properties/bool2'
label: bool2
options:
format: checkbox
- type: Control
scope: '#/properties/date'
label: date
- type: Control
scope: '#/properties/enum'
label: enum
options:
format: radio
created: 2022-07-25T12:56:31.000Z
lastUpdated: 2022-07-26T11:53:59.000Z
_links:
self:
href: https://exmaple.com/api/v1/meta/uischemas/uis4a7liocgcRgcxZ0g7
hints:
allow:
- GET
- PUT
- DELETE
RiskEventsRequestExample:
summary: Risk Events payload example
value:
- timestamp: 2021-01-20T00:00:00.001Z
subjects:
- ip: 6.7.6.7
riskLevel: MEDIUM
- ip: 1.1.1.1
riskLevel: HIGH
message: Detected Attack tooling and suspicious activity
- timestamp: 2021-01-20T01:00:00.001Z
subjects:
- ip: 6.7.6.7
riskLevel: LOW
- ip: 2.2.2.2
riskLevel: HIGH
RiskProviderPutRequest:
summary: Replace Risk Provider request example
value:
name: Risk-Partner-Y
action: enforce_and_log
clientId: 00ckjsfgjkdkjdkkljjsd
RiskProviderPutResponse:
summary: Replace Risk Provider response example
value:
id: 00rp12r4skkjkjgsn
action: enforce_and_log
name: Risk-Partner-Y
clientId: 00ckjsfgjkdkjdkkljjsd
created: 2021-01-05 22:18:30
lastUpdated: 2021-01-05 23:18:30
_links:
self:
href: "https://{yourOktaDomain}/api/v1/risk/providers/00rp12r4skkjkjgsn"
hints:
allow:
- GET
- PUT
RiskProviderRequest:
summary: Risk Provider payload example
value:
name: Risk-Partner-X
action: log_only
clientId: 00ckjsfgjkdkjdkkljjsd
RiskProviderResponse:
summary: Risk Provider response example
value:
id: 00rp12r4skkjkjgsn
action: log_only
name: Risk-Partner-X
clientId: 00ckjsfgjkdkjdkkljjsd
created: 2021-01-05 22:18:30
lastUpdated: 2021-01-05 22:18:30
_links:
self:
href: "https://{yourOktaDomain}/api/v1/risk/providers/00rp12r4skkjkjgsn"
hints:
allow:
- GET
- PUT
RoleAssignedUsersResponseExample:
value:
value:
- id: 00u118oQYT4TBGuay0g4
orn: orn:okta:00o5rb5mt2H3d1TJd0h7:users:00u118oQYT4TBGuay0g4
_links:
self:
href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4
roles:
href: http://your-subdomain.okta.com/api/v1/users/00u118oQYT4TBGuay0g4/roles
_links:
next:
href: http://your-subdomain.okta.com/api/v1/iam/assignees/users?after=00u118oQYT4TBGuay0g4&limit=1
RoleRequest:
value:
label: UserCreator
description: Create users
permissions:
- okta.users.create
- okta.users.read
- okta.groups.read
- okta.users.userprofile.manage
RoleResponse:
value:
id: cr0Yq6IJxGIr0ouum0g3
label: UserCreator
description: Create users
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
RolesResponse:
value:
roles:
- id: cr0Yq6IJxGIr0ouum0g3
label: UserCreator
description: Create users
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3/permissions"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
- id: cr0Fw7HKcWIroo88m3r1
label: GroupMembershipManager
description: Manage group membership
created: 2021-02-06T16:20:57.000Z
lastUpdated: 2021-02-06T16:20:57.000Z
_links:
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Fw7HKcWIroo88m3r1/permissions"
self:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Fw7HKcWIroo88m3r1"
_links:
next:
href: "https://{yourOktaDomain}/api/v1/iam/roles?after=cr0Fw7HKcWIroo88m3r1"
SAMLHookResponseExample:
summary: A sample response for a SAML inline hook
value:
commands:
- type: com.okta.assertion.patch
value:
- op: replace
path: /claims/array/attributeValues/1/value
value: replacementValue
- op: replace
path: /authentication/authnContext
value:
authnContextClassRef: replacementValue
- op: add
path: /claims/extPatientId
value:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:basic
attributeValues:
- attributes:
xsi:type: xs:string
value: "4321"
- op: add
path: /authentication/sessionLifetime
value: 300
- type: com.okta.assertion.patch
value:
- op: replace
path: /authentication/sessionIndex
value: exampleSession
SAMLHookResponseWithURIFormat:
summary: An example with `replace` and `add` operations with the URI formatted
claim encoded
value:
commands:
- type: com.okta.assertion.patch
value:
- op: replace
path: /claims/http:~1~1schemas.xmlsoap.org~1ws~12005~105~1identity~1claims~1foo/attributeValues/0/value
value: replacementValue
- op: replace
path: /claims/http:~1~1schemas.xmlsoap.org~1ws~12005~105~1identity~1claims~1foo/attributes
value:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:basic
- op: add
path: /claims/http:~1~1schemas.xmlsoap.org~1ws~12005~105~1identity~1claims~1bar
value:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:basic
attributeValues:
- attributes:
xsi:type: xs:string
value: bearer
SAMLPayLoadExample:
summary: An example SAML assertion inline hook request body
value:
source: "https://${yourOktaDomain}/app/saml20app_1/exkth8lMzFm0HZOTU0g3/sso/saml"
eventId: XMFoHCM1S4Wi_SGWzL8T9A
eventTime: 2019-03-28T19:15:23.000Z
data:
context:
request:
id: reqqXypjzYJRSu2j1G1imUovA
method: GET
url:
value: "https://${yourOktaDomain}/app/saml20app_1/exkth8lMzFm0HZOTU0g3/sso/saml"
ipAddress: 127.0.0.1
protocol:
type: SAML2.0
issuer:
id: 0oath92zlO60urQOP0g3
name: SAML 2.0 App
uri: http://www.okta.com/exkth8lMzFm0HZOTU0g3
session:
id: 102LN9Bnuc4S_ewfc9BYwageA
userId: 00uq8tMo3zV0OfJON0g3
login: [email protected]
createdAt: 2019-03-28T16:45:55.000Z
expiresAt: 2019-03-28T21:15:23.000Z
status: ACTIVE
lastPasswordVerification: 2019-03-28T16:45:55.000Z
amr:
- PASSWORD
idp:
id: 00oq6kcVwvrDY2YsS0g3
type: OKTA
mfaActive: false
user:
id: 00uq8tMo3zV0OfJON0g3
passwordChanged: 2018-09-11T23:19:12.000Z
profile:
login: [email protected]
firstName: Admin
lastName: Last
locale: en
timeZone: America/Los_Angeles
_links:
groups:
href: "https://${yourOktaDomain}/00uq8tMo3zV0OfJON0g3/groups"
factors:
href: "https://${yourOktaDomain}/api/v1/users/00uq8tMo3zV0OfJON0g3/factors"
assertion:
subject:
nameId: [email protected]
nameFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
confirmation:
method: urn:oasis:names:tc:SAML:2.0:cm:bearer
data:
recipient: http://www.example.com:7070/saml/sso
authentication:
sessionIndex: id1553800523546.312669168
authnContext:
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
conditions:
audienceRestriction:
- urn:example:sp
claims:
extPatientId:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
attributeValues:
- attributes:
xsi:type: xs:integer
value: "4321"
array:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
attributeValues:
- attributes:
xsi:type: xs:string
value: Array 1
- attributes:
xsi:type: xs:string
value: Array2
- attributes:
xsi:type: xs:string
value: Array3
middle:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
attributeValues:
- attributes:
xsi:type: xs:string
value: admin
firstAndLast:
attributes:
NameFormat: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
attributeValues:
- attributes:
xsi:type: xs:string
value: 7d6a50c8-4d7e-4058-9c5b-2cc98cecd294
lifetime:
expiration: 300
eventTypeVersion: "1.0"
cloudEventVersion: "0.1"
eventType: com.okta.saml.tokens.transform
contentType: application/json
SMSTemplateEditablePropertyValues:
value:
name: Custom
type: SMS_VERIFY_CODE
template: "${org.name}: your verification code is ${code}"
translations:
es: "${org.name}: el código de verificación es ${code}"
fr: "${org.name}: votre code de vérification est ${code}"
it: "${org.name}: il codice di verifica è ${code}"
SMSTemplateListResponse:
value:
- id: 6NQUJ5yR3bpgEiYmq8IC
name: Custom
type: SMS_VERIFY_CODE
template: "${org.name}: your verification code is ${code}"
translations:
es: "${org.name}: el código de verificación es ${code}"
fr: "${org.name}: votre code de vérification est ${code}"
it: "${org.name}: il codice di verifica è ${code}"
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
SMSTemplateResponseValues:
value:
id: 6NQUJ5yR3bpgEiYmq8IC
name: Custom
type: SMS_VERIFY_CODE
template: "${org.name}: your verification code is ${code}"
translations:
es: "${org.name}: el código de verificación es ${code}"
fr: "${org.name}: votre code de vérification est ${code}"
it: "${org.name}: il codice di verifica è ${code}"
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
Saml2.0Ex:
summary: SAML_2_0
value:
label: Example Custom SAML 2.0 App
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
signOnMode: SAML_2_0
settings:
signOn:
defaultRelayState: ""
ssoAcsUrl: http://testorgone.okta
idpIssuer: "http://www.okta.com/${org.externalKey}"
audience: asdqwe123
recipient: http://testorgone.okta
destination: http://testorgone.okta
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
samlAssertionLifetimeSeconds: 3600
slo:
enabled: true
issuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
participateSlo:
enabled: true
logoutRequestUrl: https://testorgone.okta.com/logout/participate
sessionIndexRequired: true
bindingType: REDIRECT
spCertificate:
x5c:
- "MIIFnDCCA4QCCQDBSLbiON2T1zANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxDjAMBgNV\r\
\n"
requestCompressed: false
allowMultipleAcsEndpoints: true
acsEndpoints:
- url: http://testorgone.okta
index: 0
- url: http://testorgone.okta/1
index: 1
attributeStatements:
- type: EXPRESSION
name: Attribute
namespace: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
values:
- Value
Saml2.0PutEx:
summary: SAML_2_0
value:
label: Example Custom SAML 2.0 App updated
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
signOnMode: SAML_2_0
settings:
signOn:
defaultRelayState: ""
ssoAcsUrl: http://testorgone.okta
idpIssuer: "http://www.okta.com/${org.externalKey}"
audience: asdqwe123
recipient: http://testorgone.okta
destination: http://testorgone.okta
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
samlAssertionLifetimeSeconds: 3600
slo:
enabled: true
issuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
participateSlo:
enabled: true
logoutRequestUrl: https://testorgone.okta.com/logout/participate
sessionIndexRequired: true
bindingType: REDIRECT
spCertificate:
x5c:
- "MIIFnDCCA4QCCQDBSLbiON2T1zANBgkqhkiG9w0BAQsFADCBjzELMAkGA1UEBhMCVVMxDjAMBgNV\r\
\n..."
requestCompressed: false
allowMultipleAcsEndpoints: true
acsEndpoints:
- url: http://testorgone.okta
index: 0
- url: http://testorgone.okta/1
index: 1
attributeStatements:
- type: EXPRESSION
name: Attribute
namespace: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
values:
- Value
Saml2.0PutResponseEx:
summary: SAML_2_0
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
testorgone_examplecustomsaml20app_1_link: true
name: testorgone_examplecustomsaml20app_1
label: Example Custom SAML 2.0 App updated
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
signing:
kid: mh_16Cc8sIfHMFDMlHnp194cxKvJ6yXqs_mNn_6ZC0Q
settings:
app: {}
signOn:
defaultRelayState: null
ssoAcsUrl: http://testorgone.okta
idpIssuer: "http://www.okta.com/${org.externalKey}"
audience: asdqwe123
recipient: http://testorgone.okta
destination: http://testorgone.okta
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
spIssuer: https://testorgone.okta.com
samlAssertionLifetimeSeconds: 3600
slo:
enabled: true
issuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
requestCompressed: false
allowMultipleAcsEndpoints: false
acsEndpoints: []
samlSignedRequestEnabled: false
attributeStatements:
- type: EXPRESSION
name: Attribute
namespace: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
values:
- Value
inlineHooks: []
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
Saml2.0ResponseEx:
summary: SAML_2_0
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
testorgone_examplecustomsaml20app_1_link: true
name: testorgone_examplecustomsaml20app_1
label: Example Custom SAML 2.0 App
features: []
signOnMode: SAML_2_0
credentials:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
signing:
kid: mh_16Cc8sIfHMFDMlHnp194cxKvJ6yXqs_mNn_6ZC0Q
settings:
app: {}
signOn:
defaultRelayState: null
ssoAcsUrl: http://testorgone.okta
idpIssuer: "http://www.okta.com/${org.externalKey}"
audience: asdqwe123
recipient: http://testorgone.okta
destination: http://testorgone.okta
subjectNameIdTemplate: "${user.userName}"
subjectNameIdFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
responseSigned: true
assertionSigned: true
signatureAlgorithm: RSA_SHA256
digestAlgorithm: SHA256
honorForceAuthn: true
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
spIssuer: https://testorgone.okta.com
samlAssertionLifetimeSeconds: 3600
slo:
enabled: true
issuer: https://testorgone.okta.com
logoutUrl: https://testorgone.okta.com/logout
requestCompressed: false
allowMultipleAcsEndpoints: false
acsEndpoints: []
samlSignedRequestEnabled: false
attributeStatements:
- type: EXPRESSION
name: Attribute
namespace: urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified
values:
- Value
inlineHooks: []
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
SamlIdPResponse:
summary: SAML 2.0 Identity Provider
value:
id: 0oa62bc8wppPw0UGr0h7
type: SAML2
name: Example SAML IdP
status: ACTIVE
created: 2016-03-24T23:14:54.000Z
lastUpdated: 2016-03-24T23:14:54.000Z
protocol:
type: SAML2
endpoints:
sso:
url: https://idp.example.com
binding: HTTP-POST
destination: https://idp.example.com
acs:
binding: HTTP-POST
type: INSTANCE
algorithms:
request:
signature:
algorithm: SHA-256
scope: REQUEST
response:
signature:
algorithm: SHA-256
scope: ANY
settings:
nameFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
credentials:
trust:
issuer: https://idp.example.com
audience: http://www.okta.com/123
kid: your-key-id
policy:
provisioning:
action: AUTO
profileMaster: true
groups:
action: NONE
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter: null
action: AUTO
subject:
userNameTemplate:
template: saml.subjectNameId
filter: (\S+@example\.com)
matchType: USERNAME
mapAMRClaims: false
maxClockSkew: 0
_links:
metadata:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/metadata.xml"
type: application/xml
hints:
allow:
- GET
acs:
href: "https://{yourOktaDomain}/sso/saml2/0oa62bc8wppPw0UGr0h7"
type: application/xml
hints:
allow:
- POST
users:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/users"
hints:
allow:
- GET
deactivate:
href: "https://{yourOktaDomain}/api/v1/idps/0oa62bc8wppPw0UGr0h7/lifecycle/deactivate"
hints:
allow:
- POST
SecurePasswordStoreEx:
summary: SECURE_PASSWORD_STORE
value:
name: template_sps
label: Example SWA App
signOnMode: SECURE_PASSWORD_STORE
settings:
app:
url: https://example.com/login.html
passwordField: '#txtbox-password'
usernameField: '#txtbox-username'
optionalField1: param1
optionalField1Value: somevalue
optionalField2: param2
optionalField2Value: yetanothervalue
optionalField3: param3
optionalField3Value: finalvalue
SecurePasswordStorePutEx:
summary: SECURE_PASSWORD_STORE
value:
name: template_sps
label: Example SWA App updated
signOnMode: SECURE_PASSWORD_STORE
settings:
app:
url: https://example.com/login.html
passwordField: '#txtbox-password'
usernameField: '#txtbox-username'
optionalField1: param1
optionalField1Value: somevalue_updated
optionalField2: param2
optionalField2Value: yetanothervalue
optionalField3: param3
optionalField3Value: finalvalue_updated
SecurePasswordStorePutResponseEx:
summary: SECURE_PASSWORD_STORE
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
name: template_sps
label: Example SWA App updated
features: []
signOnMode: SECURE_PASSWORD_STORE
credentials:
scheme: EDIT_USERNAME_AND_PASSWORD
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
revealPassword: false
signing: {}
settings:
app:
url: https://example.com/login.html
passwordField: '#txtbox-password'
usernameField: '#txtbox-username'
optionalField1: param1
optionalField1Value: somevalue_updated
optionalField2: param2
optionalField2Value: yetanothervalue
optionalField3: param3
optionalField3Value: finalvalue_updated
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
SecurePasswordStoreResponseEx:
summary: SECURE_PASSWORD_STORE
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
name: template_sps
label: Example SWA App
features: []
signOnMode: SECURE_PASSWORD_STORE
credentials:
scheme: EDIT_USERNAME_AND_PASSWORD
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
revealPassword: false
signing: {}
settings:
app:
url: https://example.com/login.html
passwordField: '#txtbox-password'
usernameField: '#txtbox-username'
optionalField1: param1
optionalField1Value: somevalue
optionalField2: param2
optionalField2Value: yetanothervalue
optionalField3: param3
optionalField3Value: finalvalue
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
SecurityEventsProviderRequestIssuerAndJwksUrl:
summary: Provider with issuer and JWKS
value:
name: Security Events Provider with an issuer and a JWKS URL
type: okta
settings:
issuer: Issuer
jwks_url: https://example.okta.com/jwks/path
SecurityEventsProviderRequestWellKnownUrl:
summary: Provider with well-known URL
value:
name: Security Events Provider with well-known URL
type: okta
settings:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
SecurityEventsProviderResponseIssuerAndJwksUrl:
summary: Provider with issuer and JWKS
value:
id: sse1qu4fUtsoD12iF0g5
name: Security Events Provider with an issuer and a JWKS URL
type: okta
status: ACTIVE
settings:
issuer: Issuer
jwks_url: https://example.okta.com/jwks/path
_links:
self:
href: https://example.okta.com/api/v1/security-events-providers/sse1qu4fUtsoD12iF0g5
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: https://example.okta.com/api/v1/security-events-providers/sse1qu4fUtsoD12iF0g5/lifecycle/deactivate
hints:
allow:
- POST
SecurityEventsProviderResponseWellKnownUrl:
summary: Provider with well-known URL
value:
id: sse1qg25RpusjUP6m0g5
name: Security Events Provider with well-known URL
type: okta
status: ACTIVE
settings:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
issuer: Issuer
jwks_url: https://example.okta.com/jwks/path
_links:
self:
href: https://example.okta.com/api/v1/security-events-providers/sse1qg25RpusjUP6m0g5
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: https://example.okta.com/api/v1/security-events-providers/sse1qg25RpusjUP6m0g5/lifecycle/deactivate
hints:
allow:
- POST
SimulatePolicyBody:
description: Simulate policy request body
summary: Simulate policy request body
value:
policyType:
- OKTA_SIGN_ON
- MFA_ENROLL
appInstance: 0oa4eroj3nYCIJIW70g7
policyContext:
groups:
ids:
- 00g4eralvekR5RLuS0g7
- 00g4eralvekR5RLuS0g8
risk:
level: LOW
zones:
ids:
- nzo4eralxcRnbIHYJ0g7
device:
platform: IOS
registered: true
managed: true
SimulatePolicyElExpressionBody:
description: Simulate policy request body with EL context
summary: Simulate policy request body with EL context
value:
appInstance: 0oa4fdudGhhB5FNKR0g4
policyContext:
user:
id: 00u10wvS3zms2JVaO0g4
status: ACTIVE
created: 2024-04-29T18:05:24.000Z
lastUpdated: 2024-04-29T18:05:24.000Z
passwordChanged: 2024-04-29T18:05:24.000Z
lastLogin: 2024-04-29T18:05:24.000Z
profile:
city: string
costCenter: string
countryCode: st
department: string
displayName: string
division: string
email: [email protected]
employeeNumber: string
firstName: string
honorificPrefix: string
honorificSuffix: string
lastName: string
locale: string
login: string
manager: string
managerId: string
middleName: string
mobilePhone: string
nickName: string
organization: string
postalAddress: string
preferredLanguage: string
primaryPhone: string
profileUrl: string
secondEmail: [email protected]
state: string
streetAddress: string
timezone: string
title: string
userType: string
zipCode: string
SimulatePolicyElExpressionResponse:
description: Simulate policy response body with EL Context
summary: Simulate policy response body with EL Context
value:
evaluation:
- status: null
policyType: OKTA_SIGN_ON
result:
policies:
- id: 00p4eromwukk6qUku0g7
name: test policy
status: MATCH
conditions: []
rules:
- id: 0pr4erof85nGcyC7Y0g7
name: test rule
status: MATCH
conditions:
- type: people.groups.include
status: MATCH
undefined:
policies: []
evaluated:
policies: []
- status: null
policyType: MFA_ENROLL
result:
policies:
- id: 00p4eram2kw1aLcrx0g7
name: Default Policy
status: MATCH
conditions: []
rules:
- id: 0pr4eram2lMQT5FZF0g7
name: null
status: MATCH
conditions: []
undefined:
policies: []
evaluated:
policies: []
- status: null
policyType: ACCESS_POLICY
result:
policies:
- id: rst4eram06ZKZewEe0g7
name: Any two factors
status: MATCH
conditions: []
rules:
- id: rul4eram07VsWgybo0g7
name: Catch-all rule
status: MATCH
conditions: []
undefined:
policies: []
evaluated:
policies: []
- status: null
policyType: PROFILE_ENROLLMENT
result:
policies:
- id: rst4eram08ZSjPTOl0g7
name: Default Policy
status: MATCH
conditions: []
rules:
- id: rul4eram094PrQ2BX0g7
name: Catch-all rule
status: MATCH
conditions: []
undefined:
policies: []
evaluated:
policies: []
SimulatePolicyResponse:
description: Simulate policy response body
summary: Simulate policy response body
value:
evaluation:
- status: null
policyType: OKTA_SIGN_ON
result:
policies:
- id: 00p4eromwukk6qUku0g7
name: test policy
status: MATCH
conditions: []
rules:
- id: 0pr4erof85nGcyC7Y0g7
name: test rule
status: MATCH
conditions:
- type: people.groups.include
status: MATCH
undefined:
policies: []
evaluated:
policies: []
- status: null
policyType: MFA_ENROLL
result:
policies:
- id: 00p4eram2kw1aLcrx0g7
name: Default Policy
status: MATCH
conditions: []
rules:
- id: 0pr4eram2lMQT5FZF0g7
name: null
status: MATCH
conditions: []
undefined:
policies: []
evaluated:
policies: []
- status: null
policyType: ACCESS_POLICY
result:
policies:
- id: rst4eram06ZKZewEe0g7
name: Any two factors
status: MATCH
conditions: []
rules:
- id: rul4eram07VsWgybo0g7
name: Catch-all rule
status: MATCH
conditions: []
undefined:
policies: []
evaluated:
policies: []
- status: null
policyType: PROFILE_ENROLLMENT
result:
policies:
- id: rst4eram08ZSjPTOl0g7
name: Default Policy
status: MATCH
conditions: []
rules:
- id: rul4eram094PrQ2BX0g7
name: Catch-all rule
status: MATCH
conditions: []
undefined:
policies: []
evaluated:
policies: []
SmartCardIdPResponse:
summary: SmartCard Identity Provider
value:
id: 0oa6jxasyhwM2ZHJh0g4
type: X509
name: Smart Card IDP Name
status: ACTIVE
created: 2020-01-07T00:19:27.000Z
lastUpdated: 2020-01-07T00:19:27.000Z
properties:
additionalAmr:
- sc
- hwk
- pin
- mfa
protocol:
type: MTLS
endpoints:
sso:
url: "https://{yourOktaDomain}.okta.com/login/cert"
credentials:
trust:
issuer: "CN=Test Smart Card, OU=Test OU, O=Test O, C=US"
audience: null
kid: 45dec5ff-8cdc-48c0-85fe-a4869f1753dc
revocation: CRL
revocationCacheLifetime: 2880
policy:
provisioning:
action: DISABLED
profileMaster: false
groups: null
subject:
userNameTemplate:
template: idpuser.subjectAltNameEmail
filter: null
matchType: EMAIL
matchAttribute: null
mapAMRClaims: false
maxClockSkew: 120000
_links:
deactivate:
href: "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/lifecycle/deactivate"
hints:
allow:
- POST
users:
href: "https://{yourOktaDomain}.okta.com/api/v1/idps/0oa6jxasyhwM2ZHJh0g4/users"
hints:
allow:
- GET
keys:
href: "https://{yourOktaDomain}.okta.com/api/v1/idps/credentials/keys/45dec5ff-8cdc-48c0-85fe-a4869f1753dc"
hints:
allow:
- GET
SocialAuthTokensResponse:
summary: Social Authentication Tokens
value:
- id:
token: JBTWGV22G4ZGKV3N
tokenType: urn:ietf:params:oauth:token-type:access_token
tokenAuthScheme: Bearer
expiresAt: 2014-08-06T16:56:31.000Z
scopes:
- openid
- foo
- id:
token: JBTWGV22G4ZJBRXJ
tokenType: urn:ietf:params:oauth:token-type:id_token
tokenAuthScheme: null
StandardAndCustomRolesListResponse:
value:
- id: IFIFAX2BIRGUSTQ
label: Application Administrator
type: APP_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: JBCUYUC7IRCVGS27IFCE2SKO
label: Help Desk Administrator
type: HELP_DESK_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: ra125eqBFpETrMwu80g4
label: Organization Administrator
type: ORG_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: gra25fapn1prGTBKV0g4
label: API Access Management Administrator
type: API_ACCESS_MANAGEMENT_ADMIN
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: GROUP
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/groups/00g1ousb3XCr9Dkr20g4"
- id: irb1q92TFAHzySt3x0g4
role: cr0Yq6IJxGIr0ouum0g3
label: UserCreatorRole
type: CUSTOM
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: USER
resource-set: iamoJDFKaJxGIr0oamd9g
_links:
assignee:
href": "https://{yourOktaDomain}/api/v1/users/00u1gytb3XCr9Dkr18r2"
resource-set:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g"
member:
href: "https://{yourOktaDomain}/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{yourOktaDomain}/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
permissions:
href: "https://{yourOktaDomain}/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions"
- id: irb5e92YgBazyyQ3x1q5
role: cr0Yq6IJxGIr0ouum0g3
label: UserCreatorRole
type: CUSTOM
status: ACTIVE
created: 2019-02-06T16:20:57.000Z
lastUpdated: 2019-02-06T16:20:57.000Z
assignmentType: GROUP
resource-set: iamoakjsdQaJxGIr03int1o
_links:
assignee:
href: "https://{ yourOktaDomain }/api/v1/groups/00g1ousb3XCr9Dkr20g4"
resource-set:
href: "https://{ yourOktaDomain }/api/v1/iam/resource-sets/iamoakjsdQaJxGIr03int1o"
member:
href: "https://{ yourOktaDomain }/api/v1/iam/resource-sets/iamoJDFKaJxGIr0oamd9g/bindings/cr0Yq6IJxGIr0ouum0g3/members/irb1qe6PGuMc7Oh8N0g4"
role:
href: "https://{ yourOktaDomain }/api/v1/iam/roles/cr0Yq6IJxGIr0ouum0g3"
permissions:
href: "https://{ yourOktaDomain }/api/v1/iam/permission-sets/cr0Yq6IJxGIr0ouum0g3/permissions"
StandardRoleAssignmentRequest:
value:
type: HELP_DESK_ADMIN
StandardRoleResponseClient:
value:
id: JBCUYUC7IRCVGS27IFCE2SKO
label: Help Desk Administrator
type: HELP_DESK_ADMIN
status: ACTIVE
created: 2023-05-01T14:24:54.000Z
lastUpdated: 2023-05-01T14:24:54.000Z
assignmentType: CLIENT
_links:
assignee:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0jrabyQWm4B9zVJPbotY/roles"
StandardRoleResponseUser:
value:
id: ra1b8anIk7rx7em7L0g4
label: Super Organization Administrator
type: SUPER_ADMIN
status: ACTIVE
created: 2015-09-06T15:28:47.000Z
lastUpdated: 2015-09-06T15:28:47.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
StandardRolesListResponse:
value:
- id: IFIFAX2BIRGUSTQ
label: Application Administrator
type: APP_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: JBCUYUC7IRCVGS27IFCE2SKO
label: Help Desk Administrator
type: HELP_DESK_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: ra125eqBFpETrMwu80g4
label: Organization Administrator
type: ORG_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: USER
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
- id: gra25fapn1prGTBKV0g4
label: API Access Management Administrator
type: API_ACCESS_MANAGEMENT_ADMIN
status: ACTIVE
created": 2019-02-06T16:20:57.000Z
lastUpdated": 2019-02-06T16:20:57.000Z
assignmentType": GROUP
_links":
assignee":
href": "https://{yourOktaDomain}/api/v1/groups/00g1ousb3XCr9Dkr20g4"
StandardRolesListResponseClient:
value:
- id: JBCUYUC7IRCVGS27IFCE2SKO
label: Help Desk Administrator
type: HELP_DESK_ADMIN
status: ACTIVE
created: 2023-05-01T14:24:54.000Z
lastUpdated: 2023-05-01T14:24:54.000Z
assignmentType: CLIENT
_links:
assignee:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0jrabyQWm4B9zVJPbotY/roles"
StandardRolesListResponseGroup:
value:
- id: IFIFAX2BIRGUSTQ
label: Application Administrator
type: APP_ADMIN
status: ACTIVE
created: 2019-02-06T16:17:40.000Z
lastUpdated: 2019-02-06T16:17:40.000Z
assignmentType: GROUP
_links:
assignee:
href: "https://{yourOktaDomain}/api/v1/users/00ur32Vg0fvpyHZeQ0g3"
SubmissionOidcRequest:
summary: Submission OIDC request example
value:
name: Strawberry Central
description: Your one source for in-season strawberry deals
logo: https://acme.okta.com/bc/image/fileStoreRecord?id=fs03xxd3KmkDBwJU80g4
sso:
oidc:
redirectUris:
- "https://${org.subdomain}.example.com/strawberry/oidc/login"
initiateLoginUri: "https://${org.subdomain}.example.com/strawberry/oidc/sp-init"
postLogoutUris:
- "https://${org.subdomain}.example.com/strawberry/oidc/logged-out"
doc: https://example.com/strawberry/help/oidcSetup
config:
- name: subdomain
label: Subdomain
SubmissionOidcResponse:
summary: Submission OIDC response example
value:
id: acme_strawberrycentral_1
name: Strawberry Central
description: Your one source for in-season strawberry deals
logo: https://acme.okta.com/bc/image/fileStoreRecord?id=fs03xxd3KmkDBwJU80g4
sso:
oidc:
redirectUris:
- "https://${org.subdomain}.example.com/strawberry/oidc/login"
initiateLoginUri: "https://${org.subdomain}.example.com/strawberry/oidc/sp-init"
postLogoutUris:
- "https://${org.subdomain}.example.com/strawberry/oidc/logged-out"
doc: https://example.com/strawberry/help/oidcSetup
config:
- name: subdomain
label: Subdomain
status: New
lastUpdated: 2023-08-24T14:15:22.000Z
lastUpdatedBy: 00ub0oNGTSWTBKOLGLNR
lastPublished: 2023-09-01T13:23:45.000Z
SubmissionSamlRequest:
summary: Submission SAML request example
value:
name: Strawberry Central
description: Your one source for in-season strawberry deals
logo: https://acme.okta.com/bc/image/fileStoreRecord?id=fs03xxd3KmkDBwJU80g4
sso:
saml:
acs:
- url: "https://${org.subdomain}.example.com/saml/login"
entityId: "https://${org.subdomain}.example.com"
claims:
- name: manager
values:
- "${user.manager}"
groups:
- name: groups
doc: https://example.com/strawberry/help/samlSetup
config:
- name: subdomain
label: Subdomain
SubmissionSamlResponse:
summary: Submission SAML response example
value:
id: acme_strawberrycentral_1
name: Strawberry Central
description: Your one source for in-season strawberry deals
logo: https://acme.okta.com/bc/image/fileStoreRecord?id=fs03xxd3KmkDBwJU80g4
sso:
saml:
acs:
- url: "https://${org.subdomain}.example.com/saml/login"
entityId: "https://${org.subdomain}.example.com"
claims:
- name: manager
values:
- "${user.manager}"
groups:
- name: groups
doc: https://example.com/strawberry/help/samlSetup
config:
- name: subdomain
label: Subdomain
status: To be reviewed by Okta
lastUpdated: 2023-08-24T14:15:22.000Z
lastUpdatedBy: 00ub0oNGTSWTBKOLGLNR
lastPublished: null
SubmissionsResponse:
summary: Submission list example
value:
- id: acme_strawberrycentral_1
name: Strawberry Central
description: Your one source for in-season strawberry deals
logo: https://acme.okta.com/bc/image/fileStoreRecord?id=fs03xxd3KmkDBwJU80g4
sso:
saml:
acs:
- url: "https://${org.subdomain}.example.com/saml/login"
entityId: "https://${org.subdomain}.example.com"
claims:
- name: manager
values:
- "${user.manager}"
groups:
- name: groups
doc: https://example.com/strawberry/help/samlSetup
config:
- name: subdomain
label: Subdomain
status: Complete
lastUpdated: 2023-08-24T14:15:22.000Z
lastUpdatedBy: 00ub0oNGTSWTBKOLGLNR
lastPublished: 2023-09-01T13:23:45.000Z
SupportedFactorResults:
value:
- factorType: question
provider: OKTA
vendorName: OKTA
_links:
questions:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/questions"
hints:
allow:
- GET
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
- factorType: token:software:totp
provider: OKTA
_links:
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
- factorType: token:software:totp
provider: GOOGLE
_links:
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
- factorType: sms
provider: OKTA
vendorName: OKTA
_links:
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
_embedded:
phones:
- id: mblldntFJevYKbyQQ0g3
profile:
phoneNumber: "+14081234567"
status: ACTIVE
- factorType: call
provider: OKTA
_links:
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
- factorType: token
provider: RSA
_links:
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
- factorType: token
provider: SYMANTEC
_links:
enroll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors"
hints:
allow:
- POST
TelephonyFailureResponse:
summary: A sample response for external webservice returning failure
value:
error:
- errorSummary: Failed to deliver SMS OTP to [email protected]
- errorCauses:
errorSummary: Provider could not deliver OTP
reason: The content of the message is not supported
location: South Africa
TelephonyPayloadExample:
summary: An example Telephony inline hook request body
value:
eventId: uS5871kJThSsU8qlA1LTcg
eventTime: 2020-01-17T21:23:56.000Z
eventType: com.okta.telephony.provider
eventTypeVersion: "1.0"
contentType: application/json
cloudEventVersion: "0.1"
source: "https://${yourOktaDomain}/api/v1/inlineHooks/cbl2ad6phv9fsPLcF0g7"
data:
context:
request:
id: reqRgSk8IBBRhuo0YdlEDTmUw
method: POST
url:
value: /api/internal/v1/inlineHooks/com.okta.telephony.provider/generatePreview
ipAddress: 127.0.0.1
userProfile:
firstName: test
lastName: user
login: [email protected]
userId: 00uyxxSknGtK8022w0g3
messageProfile:
msgTemplate: (HOOK)Your code is 11111
phoneNumber: 9876543210
otpExpires: 2022-01-28T21:48:34.321Z
deliveryChannel: SMS
otpCode: 11111
locale: EN-US
TelephonySuccessResponse:
summary: A sample response for external webservice returning success
value:
commands:
- type: com.okta.telephony.action
- value:
status: FAILURE
provider: VONAGE
transactionId: SM49a8ece2822d44e4adaccd7ed268f954
transactionMetadata: Duration=300ms
TestInfoOidcRequest:
summary: OIDC SSO Submission Testing Information request
value:
testAccount:
url: https://example.com/strawberry/login
username: [email protected]
password: sUperP@ssw0rd
instructions: Go to your app URL from a browser and enter your credentials
escalationSupportContact: [email protected]
oidcTestConfiguration:
jit: false
spInitiateUrl: https://test.example.com/strawberry/oidc/sp-init
TestInfoOidcResponse:
summary: OIDC SSO Submission Testing Information response
value:
testAccount:
url: https://example.com/strawberry/login
username: [email protected]
password: sUperP@ssw0rd
instructions: Go to your app URL from a browser and enter your credentials
escalationSupportContact: [email protected]
oidcTestConfiguration:
idp: true
sp: true
jit: false
spInitiateUrl: https://test.example.com/strawberry/oidc/sp-init
TestInfoSamlRequest:
summary: SAML SSO Submission Testing Information request
value:
testAccount:
url: https://example.com/strawberry/login
username: [email protected]
password: sUperP@ssw0rd
instructions: Go to your app URL from a browser and enter your credentials
escalationSupportContact: [email protected]
samlTestConfiguration:
idp: true
sp: true
jit: false
spInitiateUrl: https://test.example.com/strawberry/saml/sp-init
spInitiateDescription: Go to the app URL from a browser and enter your username
TestInfoSamlResponse:
summary: SAML SSO Submission Testing Information response
value:
testAccount:
url: https://example.com/strawberry/login
username: [email protected]
password: sUperP@ssw0rd
instructions: Go to your app URL from a browser and enter your credentials
escalationSupportContact: [email protected]
samlTestConfiguration:
idp: true
sp: true
jit: false
spInitiateUrl: https://test.example.com/strawberry/saml/sp-init
spInitiateDescription: Go to the app URL from a browser and enter your username
ThreatInsightResponseExample:
summary: ThreatInsight response
value:
action: none
excludeZones: []
created: 2020-08-05T22:18:30.629Z
lastUpdated: 2020-08-05T22:18:30.629Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/threats/configuration"
hints:
allow:
- GET
- POST
ThreatInsightUpdateRequestExample:
summary: ThreatInsight update request
value:
action: audit
excludeZones:
- nzo1q7jEOsoCnoKcj0g4
- nzouagptWUz5DlLfM0g3
ThreatInsightUpdateResponseExample:
summary: ThreatInsight update response
value:
action: audit
excludeZones:
- nzo1q7jEOsoCnoKcj0g4
- nzouagptWUz5DlLfM0g3
created: 2020-08-05T22:18:30.629Z
lastUpdated: 2020-10-13T21:23:10.178Z
_links:
self:
href: "https://{yourOktaDomain}/api/v1/threats/configuration"
hints:
allow:
- GET
- POST
TokenHookErrorExample:
summary: Error response
value:
error:
errorSummary: Human-readable summary of the error
TokenHookModifyLifetime:
summary: Modify token lifetime
value:
commands:
- type: com.okta.identity.patch
value:
- op: replace
path: /token/lifetime/expiration
value: 36000
- type: com.okta.access.patch
value:
- op: replace
path: /token/lifetime/expiration
value: 36000
TokenHookRemoveClaim:
summary: Remove claim
value:
commands:
- type: com.okta.identity.patch
value:
- op: remove
path: /claims/birthdate
value: null
- type: com.okta.access.patch
value:
- op: remove
path: /claims/external_guid
TokenHookRemoveFromArray:
summary: Remove from array
value:
commands:
- type: com.okta.identity.patch
value:
- op: remove
path: /claims/preferred_airports/1
TokenHookRemoveFromObject:
summary: Remove from JSON object
value:
commands:
- type: com.okta.identity.patch
value:
- op: remove
path: /claims/employee_profile/email
TokenHookReplaceExisting:
summary: Replace an existing claim
value:
commands:
- type: com.okta.identity.patch
value:
- op: replace
path: /claims/extPatientId
value: "1234"
- op: replace
path: /claims/external_guid
value: F0384685-F87D-474B-848D-2058AC5655A7
TokenHookReplaceInPath:
summary: Replace within JSON object
value:
commands:
- type: com.okta.identity.patch
value:
- op: replace
path: /claims/employee_profile/email
value: [email protected]
TokenHookResponse:
summary: Add a claim
value:
commands:
- type: com.okta.assertion.patch
value:
- op: add
path: /claims/extPatientId
value: "1234"
- type: com.okta.assertion.patch
value:
- op: add
path: /claims/external_guid
value: F0384685-F87D-474B-848D-2058AC5655A7
TokenHookResponseAppendArray:
summary: Append to array
value:
commands:
- type: com.okta.identity.patch
value:
- op: add
path: /claims/preferred_airports/3
value: lax
TokenHookResponseWithURIFormat:
summary: Add new members to existing JSON objects
value:
commands:
- type: com.okta.identity.patch
value:
- op: add
path: /claims/employee_profile/department_id
value: "4947"
TokenPayLoadExample:
description: An example token inline hook request body
summary: Example token inline hook request body
value:
source: "https://{yourOktaDomain}/oauth2/default/v1/authorize"
eventId: 3OWo4oo-QQ-rBWfRyTmQYw
eventTime: 2019-01-15T23:20:47.000Z
eventTypeVersion: "1.0"
cloudEventVersion: "0.1"
contentType: application/json
eventType: com.okta.oauth2.tokens.transform
data: null
context:
request:
id: reqv66CbCaCStGEFc8AdfS0ng
method: GET
url:
value: "https://{yourOktaDomain}/oauth2/default/v1/authorize?scope=openid+profile+email&response_type=token+id_token&redirect_uri=https%3A%2F%2Fhttpbin.org%2Fget&state=foobareere&nonce=asf&client_id=customClientIdNative"
ipAddress: 127.0.0.1
protocol:
type: OAUTH2.0
request:
scope: openid profile email
state: foobareere
redirect_uri: https://httpbin.org/get
response_mode: fragment
response_type: token id_token
client_id: customClientIdNative
issuer:
uri: "https://{yourOktaDomain}/oauth2/default"
client:
id: customClientIdNative
name: Native client
type: PUBLIC
session:
id: 102Qoe7t5PcRnSxr8j3I8I6pA
userId: 00uq8tMo3zV0OfJON0g3
login: [email protected]
createdAt: 2019-01-15T23:17:09.000Z
expiresAt: 2019-01-16T01:20:46.000Z
status: ACTIVE
lastPasswordVerification: 2019-01-15T23:17:09.000Z
amr:
- PASSWORD
idp:
id: 00oq6kcVwvrDY2YsS0g3
type: OKTA
mfaActive: false
user:
id: 00uq8tMo3zV0OfJON0g3
passwordChanged: 2018-09-11T23:19:12.000Z
profile:
login: [email protected]
firstName: Add-Min
lastName: O'Cloudy Tud
locale: en
timeZone: America/Los_Angeles
_links:
groups:
href: "https://{yourOktaDomain}/00uq8tMo3zV0OfJON0g3/groups"
factors:
href: "https://{yourOktaDomain}/api/v1/users/00uq8tMo3zV0OfJON0g3/factors"
policy:
id: 00pq8lGaLlI8APuqY0g3
rule:
id: 0prq8mLKuKAmavOvq0g3
identity:
claims:
sub: 00uq8tMo3zV0OfJON0g3
name: Add-Min O'Cloudy Tud
email: [email protected]
ver: 1
iss: "https://{yourOktaDomain}/oauth2/default"
aud: customClientIdNative
jti: ID.YxF2whJfB3Eu4ktG_7aClqtCgjDq6ab_hgpiV7-ZZn0
amr:
- pwd
idp: 00oq6kcVwvrDY2YsS0g3
nonce: asf
preferred_username: [email protected]
auth_time: 1547594229
token:
lifetime:
expiration: 3600
access:
claims:
ver: 1
jti: AT.W-rrB-z-kkZQmHW0e6VS3Or--QfEN_YvoWJa46A7HAA
iss: "https://{yourOktaDomain}/oauth2/default"
aud: api://default
cid: customClientIdNative
uid: 00uq8tMo3zV0OfJON0g3
sub: [email protected]
firstName: Add-Min
preferred_username: [email protected]
token:
lifetime:
expiration: 3600
scopes:
openid:
id: scpq7bW1cp6dcvrz80g3
action: GRANT
profile:
id: scpq7cWJ81CIP5Qkr0g3
action: GRANT
email:
id: scpq7dxsoz6LQlRj00g3
action: GRANT
refresh_token:
jti: oarob4a0tckCkGcyo1d6
TriggerSessionResponse:
value:
- id: aps1qqonvr2SZv6o70h8
identitySourceId: 0oa3l6l6WK6h0R0QW0g4
status: TRIGGERED
importType: INCREMENTAL
created: 2022-04-04T15:56:05.000Z
lastUpdated: 2022-05-05T18:15:44.000Z
TrustedOriginBody:
summary: Trusted origin request body
value:
name: New Trusted Origin
origin: http://example.com
scopes:
- type: CORS
- type: REDIRECT
TrustedOriginBodyWithIframeEmbedding:
description: "Creates a new Trusted Origin for iFrame embedding of an Okta resource\
\ within that origin. In this example, the type \nof Okta resource is both\
\ the Okta End-User Dashboard and the Okta sign-in page.\n"
summary: Trusted origin request body with iFrame embedding (Okta End-User Dashboard
and Okta sign-in page)
value:
name: New Trusted Origin
origin: http://example.com
scopes:
- type: IFRAME_EMBED
allowedOktaApps:
- OKTA_ENDUSER
TrustedOriginBodyWithIframeEmbeddingSignIn:
description: "Creates a new Trusted Origin for iFrame embedding of an Okta resource\
\ within that origin. In this example, the Okta \nresource is the Okta sign-in\
\ page.\n"
summary: Trusted origin request body with iFrame embedding (Okta sign-in page)
value:
name: New Trusted Origin
origin: http://example.com
scopes:
- type: IFRAME_EMBED
allowedOktaApps: []
TrustedOriginInactiveResponse:
summary: Trusted origin response
value:
id: tos10hu7rkbtrFt1M0g4
name: New Trusted Origin
origin: http://example.com
status: INACTIVE
scopes:
- type: CORS
- type: REDIRECT
created: 2018-01-13T01:11:44.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastedUpdated: 2018-01-13T01:11:44.000Z
lastedUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/activate"
hints:
allow:
- POST
self:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4"
hints:
allow:
- GET
- PUT
- DELETE
TrustedOriginPut:
value:
id: tosue7JvguwJ7U6kz0g3
name: Updated Example Trusted Origin
origin: http://updated.example.com
scopes:
- type: CORS
- type: REDIRECT
status: ACTIVE
created: 2017-12-16T05:01:12.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastUpdated: 2017-12-16T05:01:12.000Z
lastUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginPutBody:
summary: Trusted origin request body
value:
value:
id: tosue7JvguwJ7U6kz0g3
name: Updated Example Trusted Origin
origin: http://updated.example.com
scopes:
- type: CORS
- type: REDIRECT
status: ACTIVE
created: 2017-12-16T05:01:12.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastUpdated: 2017-12-16T05:01:12.000Z
lastUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginPutBodyWithIframeEmbedding:
summary: Trusted origin request body with iFrame embedding
value:
value:
id: tosue7JvguwJ7U6kz0g3
name: Updated Example Trusted Origin
origin: http://updated.example.com
scopes:
- type: IFRAME_EMBED
allowedOktaApps:
- OKTA_ENDUSER
status: ACTIVE
created: 2017-12-16T05:01:12.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastUpdated: 2017-12-16T05:01:12.000Z
lastUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginPutResponse:
summary: Trusted origin response body
value:
value:
id: tosue7JvguwJ7U6kz0g3
name: Updated Example Trusted Origin
origin: http://updated.example.com
scopes:
- type: CORS
- type: REDIRECT
status: ACTIVE
created: 2017-12-16T05:01:12.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastUpdated: 2017-12-16T05:01:12.000Z
lastUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginPutResponseWithIframeEmbedding:
summary: Trusted origin response body with iFrame embedding
value:
value:
id: tosue7JvguwJ7U6kz0g3
name: Updated Example Trusted Origin
origin: http://updated.example.com
scopes:
- type: IFRAME_EMBED
allowedOktaApps:
- OKTA_ENDUSER
status: ACTIVE
created: 2017-12-16T05:01:12.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastUpdated: 2017-12-16T05:01:12.000Z
lastUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginPutWithIframeEmbedding:
value:
id: tosue7JvguwJ7U6kz0g3
name: Updated Example Trusted Origin
origin: http://updated.example.com
scopes:
- type: IFRAME_EMBED
allowedOktaApps:
- OKTA_ENDUSER
status: ACTIVE
created: 2017-12-16T05:01:12.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastUpdated: 2017-12-16T05:01:12.000Z
lastUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://${yourOktaDomain}/api/v1/trustedOrigins/tosue7JvguwJ7U6kz0g3/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginResponse:
summary: Trusted origin response
value:
id: tos10hu7rkbtrFt1M0g4
name: New Trusted Origin
origin: http://example.com
status: ACTIVE
scopes:
- type: CORS
- type: REDIRECT
created: 2018-01-13T01:11:44.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastedUpdated: 2018-01-13T01:11:44.000Z
lastedUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginResponseWithIframeEmbedding:
summary: Trusted origin response with iFrame embedding (End-User Dashboard and
Okta sign-in page)
value:
id: tos10hu7rkbtrFt1M0g4
name: New Trusted Origin
origin: http://example.com
status: ACTIVE
scopes:
- type: IFRAME_EMBED
allowedOktaApps:
- OKTA_ENDUSER
created: 2018-01-13T01:11:44.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastedUpdated: 2018-01-13T01:11:44.000Z
lastedUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginResponseWithIframeEmbeddingSignIn:
summary: Trusted origin response with iFrame embedding (Okta sign-in page)
value:
id: tos10hu7rkbtrFt1M0g4
name: New Trusted Origin
origin: http://example.com
status: ACTIVE
scopes:
- type: IFRAME_EMBED
allowedOktaApps: []
created: 2018-01-13T01:11:44.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastedUpdated: 2018-01-13T01:11:44.000Z
lastedUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate"
hints:
allow:
- POST
TrustedOriginsResponse:
summary: Trusted origins response
value:
- id: tos10hu7rkbtrFt1M0g4
name: New Trusted Origin
origin: http://example.com
status: ACTIVE
scopes:
- type: CORS
- type: REDIRECT
created: 2018-01-13T01:11:44.000Z
createdBy: 00ut5t92p6IEOi4bu0g3
lastedUpdated: 2018-01-13T01:11:44.000Z
lastedUpdatedBy: 00ut5t92p6IEOi4bu0g3
_links:
self:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/trustedOrigins/tos10hu7rkbtrFt1M0g4/lifecycle/deactivate"
hints:
allow:
- POST
UpdateAppFeatureRequestEx:
summary: Update USER_PROVISIONING request
value:
create:
lifecycleCreate:
status: ENABLED
update:
lifecycleDeactivate:
status: ENABLED
profile:
status: ENABLED
password:
status: ENABLED
seed: RANDOM
change: CHANGE
UpdateAppFeatureResponseEx:
summary: Update USER_PROVISIONING response
value:
name: USER_PROVISIONING
status: ENABLED
description: User provisioning settings from Okta to a downstream application
capabilities:
create:
lifecycleCreate:
status: ENABLED
update:
lifecycleDeactivate:
status: ENABLED
profile:
status: ENABLED
password:
status: ENABLED
seed: RANDOM
change: CHANGE
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/features/USER_PROVISIONING"
hints:
allow:
- GET
- PUT
UpdateAuthorizationServerPolicyRequest:
summary: Update Authorization Server Policy
value:
id: 00p5m9xrrBffPd9ah0g4
type: OAUTH_AUTHORIZATION_POLICY
status: ACTIVE
name: Default Policy
description: Default policy description
priority: 1
system: false
conditions:
clients":
include":
- ALL_CLIENTS
UpdateAuthorizationServerPolicyRuleRequest:
summary: Update Authorization Server Policy Rule
value:
type: RESOURCE_ACCESS
name: Default Policy Rule
priority: 1
status: ACTIVE
conditions:
people:
groups:
include:
- EVERYONE
grantTypes:
include:
- implicit
- client_credentials
- authorization_code
- password
scopes:
include:
- '*'
actions:
token:
accessTokenLifetimeMinutes: 60
refreshTokenLifetimeMinutes: 0
refreshTokenWindowMinutes: 10080
inlineHook:
id: cal4egvp1mbMldrYN0g7
UpdateBrandRequest:
value:
customPrivacyPolicyUrl: https://www.someHost.com/privacy-policy
agreeToCustomPrivacyPolicy: true
removePoweredByOkta: true
name: New Name For Brand
emailDomainId: OeD114iNkrcN6aR680g4
locale: en
defaultApp:
appInstanceId: 0oa114iNkrcN6aR680g4
appLinkName: null
classicApplicationUri: null
UpdateBrandResponse:
value:
id: bnd114iNkrcN6aR680g4
removePoweredByOkta: true
agreeToCustomPrivacyPolicy: true
name: New Name For Brand
isDefault: true
customPrivacyPolicyUrl: https://www.someHost.com/privacy-policy
emailDomainId: OeD114iNkrcN6aR680g4
defaultApp:
appInstanceId: 0oa114iNkrcN6aR680g4
appLinkName: null
classicApplicationUri: null
locale: en
_links:
self:
href: "https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4"
hints:
allow:
- GET
- PUT
- DELETE
themes:
href: "https://{yourOktaDomain}/api/v1/brands/bnd114iNkrcN6aR680g4/themes"
hints:
allow:
- GET
emailDomain:
href: "https://{yourOktaDomain}/api/v1/email-domains/OeD114iNkrcN6aR680g4"
hints:
allow:
- GET
- PUT
UpdateEmailDomainRequest:
value:
displayName: IT Admin
userName: noreply
UpdateFeatureLifecycleResponse:
summary: Update the feature lifecycle status
value:
description: Example feature description
id: ftrZooGoT8b41iWRiQs7
name: Example feature name
stage:
state: OPEN
value: BETA
status: DISABLED
type: self-service
_links:
self:
hints:
allow:
- POST
href: "https://{yourOktaDomain}/api/v1/features/ftrZooGoT8b41iWRiQs7"
dependents:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependents"
dependencies:
href: "https://{yourOktaDomain}/api/v1/features/ftrlBDFcGwYP2epXCGYn/dependencies"
UpdateInboundProvisioningFeatureRequestEx:
summary: Update INBOUND_PROVISIONING request
value:
capabilities:
importSettings:
username:
userNameFormat: EMAIL
schedule:
status: ENABLED
fullImport:
expression: 0 0 * * 0
timezone: America/New_York
incrementalImport:
expression: 0 */3 * * *
timezone: America/New_York
importRules:
userCreateAndMatch:
exactMatchCriteria: EMAIL
allowPartialMatch: false
autoConfirmPartialMatch: false
autoConfirmExactMatch: false
autoConfirmNewUsers: false
autoActivateNewUsers: false
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
UpdateInboundProvisioningFeatureResponseEx:
summary: Update INBOUND_PROVISIONING response
value:
name: INBOUND_PROVISIONING
status: ENABLED
description: In-bound provisioning settings from an application to Okta
capabilities:
importSettings:
username:
userNameFormat: EMAIL
schedule:
status: ENABLED
fullImport:
expression: 0 0 * * 0
timezone: America/New_York
incrementalImport:
expression: 0 */3 * * *
timezone: America/New_York
importRules:
userCreateAndMatch:
exactMatchCriteria: EMAIL
allowPartialMatch: false
autoConfirmPartialMatch: false
autoConfirmExactMatch: false
autoConfirmNewUsers: false
autoActivateNewUsers: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/${appId}/features/INBOUND_PROVISIONING"
hints:
allow:
- GET
- PUT
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
UpdateMappingBody:
summary: Update an existing profile mapping by updating one or more properties
value:
properties:
nickName:
expression: user.honorificPrefix + user.displayName
pushStatus: DONT_PUSH
UpdateMappingResponse:
summary: Update an existing profile mapping by updating one or more properties
value:
id: prm1k47ghydIQOTBW0g4
source:
id: otysbePhQ3yqt4cVv0g3
name: user
type: user
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/types/user/otysbePhQ3yqt4cVv0g3"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscsbePhQ3yqt4cVv0g3"
target:
id: 0oa1qmn4LZQQEH0wZ0g4
name: okta_org2org
type: appuser
_links:
self:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1qmn4LZQQEH0wZ0g4"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/apps/0oa1qmn4LZQQEH0wZ0g4/default"
properties:
fullName:
expression: user.firstName + user.lastName
pushStatus: PUSH
nickName:
expression: user.honorificPrefix + user.displayName
pushStatus: DONT_PUSH
_links:
self:
href: "https://{yourOktaDomain}/api/v1/mappings/prm1k48weFSOnEUnw0g4"
UpdateOAuth2ScopeRequest:
summary: Example scope
value:
description: Order car
name: car:order
metadataPublish: ALL_CLIENTS
UpdateOrgSettingEx:
summary: Org setting request
value:
address1: 100 1st St
address2: 6th floor
city: San Fransico
companyName: okta
country: United States
endUserSupportHelpURL: support.okta.com
phoneNumber: "+18887227871"
postalCode: "94105"
state: California
supportPhoneNumber: "+18887227871"
website: www.okta.com
UpdateRecQuestionRequest:
value:
password:
value: tlpWENT2m
recovery_question:
question: How many roads must a man walk down?
answer: forty two
UpdateRecQuestionResponse:
value:
password: {}
recovery_question:
question: How many roads must a man walk down?
provider:
type: OKTA
name: OKTA
UpdateSMSTemplateRequest:
value:
translations:
de: "${org.name}: ihre bestätigungscode ist ${code}."
UpdateSMSTemplateResponse:
value:
id: 6NQUJ5yR3bpgEiYmq8IC
name: Custom
type: SMS_VERIFY_CODE
template: "${org.name}: your verification code is ${code}"
translations:
es: "${org.name}: el código de verificación es ${code}"
fr: "${org.name}: votre code de vérification est ${code}"
it: "${org.name}: il codice di verifica è ${code}"
de: "${org.name}: ihre bestätigungscode ist ${code}."
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
UpdateThemeRequest:
value:
primaryColorHex: '#1662dd'
primaryColorContrastHex: '#000000'
secondaryColorHex: '#ebebed'
secondaryColorContrastHex: '#000000'
signInPageTouchPointVariant: OKTA_DEFAULT
endUserDashboardTouchPointVariant: OKTA_DEFAULT
errorPageTouchPointVariant: OKTA_DEFAULT
emailTemplateTouchPointVariant: OKTA_DEFAULT
loadingPageTouchPointVariant: OKTA_DEFAULT
UpdateThemeResponse:
value:
id: thdul904tTZ6kWVhP0g3
logo: "https://{yourOktaDomain}/assets/img/logos/okta-logo.47066819ac7db5c13f4c431b2687cef6.png"
favicon: "https://{yourOktaDomain}/favicon.ico"
backgroundImage: null
primaryColorHex: '#1662dd'
primaryColorContrastHex: '#000000'
secondaryColorHex: '#ebebed'
secondaryColorContrastHex: '#000000'
signInPageTouchPointVariant: OKTA_DEFAULT
endUserDashboardTouchPointVariant: OKTA_DEFAULT
errorPageTouchPointVariant: OKTA_DEFAULT
emailTemplateTouchPointVariant: OKTA_DEFAULT
loadingPageTouchPointVariant: OKTA_DEFAULT
UpdateUserTypePostRequest:
summary: Update user type request
value:
displayName: Updated Display Name
UpdateUserTypePostResponse:
summary: Update user type response
value:
id: otyfnly5cQjJT9PnR0g4
displayName: Updated Display Name
name: newUserType
description: A new custom user type
createdBy: sprz9fj1ycBcsgopy1d6
lastUpdatedBy: sprz9fj1ycBcsgopy1d6
created: 2021-07-05T20:40:38.000Z
lastUpdated: 2021-07-05T20:40:38.000Z
default: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscz9fj2jMiRBC1ZT1d6"
UpdatedEmailDomainResponse:
value:
id: OeD114iNkrcN6aR680g4
validationStatus: NOT_STARTED
displayName: IT Admin
userName: noreply
domain: example.com
validationSubdomain: mail
dnsValidationRecords:
- recordType: TXT
fqdn: _oktaverification.example.com
verificationValue: 759080212bda43e3bc825a7d73b4bb64
- recordType: CNAME
fqdn: mail.example.com
verificationValue: u22224444.wl024.sendgrid.net
- recordType: CNAME
fqdn: t02._domainkey.example.com
verificationValue: t02.domainkey.u22224444.wl024.sendgrid.net
- recordType: CNAME
fqdn: t022._domainkey.example.com
verificationValue: t02.domainkey.u22224444.wl024.sendgrid.net
UpdatedOAuth2ScopeResponse:
summary: Updated scope
value:
id: scp5yu8kLOnDzo7lh0g4
name: car:order
description: Order car
system: false
default: false
displayName: Saml Jackson
consent: REQUIRED
optional: false
metadataPublish: ALL_CLIENTS
_links:
self:
href: "https://{yourOktaDomain}/api/v1/authorizationServers/{authorizationServerId}/scopes/scp5yu8kLOnDzo7lh0g4"
hints:
allow:
- GET
- PUT
- DELETE
UploadYubikeyTokenSeedRequest:
summary: Yubikey OTP Seed
value:
serialNumber: "7886622"
publicId: ccccccijgibu
privateId: b74be6169486
aesKey: 1fcc6d8ce39bf1604e0b17f3e0a11067
UploadYubikeyTokenSeedResponse:
value:
id: ykkut4G6ti62DD8Dy0g3
created: 2020-01-10T23:04:10.000Z
lastVerified: 2020-01-10T23:04:10.000Z
lastUpdated: 2020-01-10T23:04:10.000Z
status: UNASSIGNED
profile:
serial: "000007886622"
_links:
self:
href: "https://{yourOktaDomain}/api/v1/org/factors/yubikey_token/tokens/ykkut4G6ti62DD8Dy0g3"
hints:
allow:
- GET
- DELETE
UserFactorChallengeCallResponse:
summary: call challenge
value:
factorResult: CHALLENGE
profile:
phoneNumber: "+12532236986"
phoneExtension: "1234"
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clff17zuKEUMYQAQGCOV/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/clff17zuKEUMYQAQGCOV"
hints:
allow:
- GET
- DELETE
UserFactorChallengeEmailResponse:
summary: email challenge
value:
factorResult: CHALLENGE
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/emfnf3gSScB8xXoXK0g3/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/emfnf3gSScB8xXoXK0g3"
hints:
allow:
- GET
- DELETE
UserFactorChallengePushResponse:
summary: push challenge
value:
expiresAt: 2015-04-01T15:57:32.000Z
factorResult: WAITING
_links:
poll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g"
hints:
allow:
- GET
cancel:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/mst1eiHghhPxf0yhp0g"
hints:
allow:
- DELETE
UserFactorChallengeSmsResponse:
summary: sms challenge
value:
factorResult: CHALLENGE
profile:
phoneNumber: "+12532236986"
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/smsszf1YNUtGWTx4j0g3/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/smsszf1YNUtGWTx4j0g3"
hints:
allow:
- GET
- DELETE
UserFactorChallengeU2fResponse:
summary: u2f challenge
value:
factorResult: CHALLENGE
profile:
credentialId: GAiiLsVab2m3-zL1Fi3bVtNrM9G6_MntUITHKjxkV24ktGKjLSCRnz72wCEdHCe18IvC69Aia0sE4UpsO0HpFQ
version: U2F_V2
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fuf2rovRxogXJ0nDy0g4"
hints:
allow:
- GET
- DELETE
_embedded:
challenge:
nonce: vQFwTt6zKzMV7HFPzjS2
timeoutSeconds: 20
UserFactorChallengeWebauthnResponse:
summary: webAuthn challenge
value:
factorResult: CHALLENGE
profile:
credentialId: l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA
authenticatorName: MacBook Touch ID
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/fwf2rovRxogXJ0nDy0g4"
hints:
allow:
- GET
- DELETE
_embedded:
challenge:
challenge: vQFwTt6zKzMV7HFPzjS2
extensions: {}
UserFactorVerifyCallSuccessResponse:
summary: call verify
value:
factorResult: SUCCESS
UserFactorVerifyEmailSuccessResponse:
summary: email verify
value:
factorResult: SUCCESS
UserFactorVerifyPushRejectedResponse:
summary: push verification rejected
value:
factorResult: REJECTED
profile:
credentialId: [email protected]
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3"
hints:
allow:
- GET
- DELETE
UserFactorVerifyPushTransactionApproved:
summary: SUCCESS
value:
factorResult: SUCCESS
UserFactorVerifyPushTransactionRejected:
summary: REJECTED
value:
factorResult: REJECTED
profile:
credentialId: [email protected]
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3"
hints:
allow:
- GET
- DELETE
UserFactorVerifyPushTransactionTimeout:
summary: TIMEOUT
value:
factorResult: TIMEOUT
profile:
credentialId: [email protected]
_links:
verify:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/verify"
hints:
allow:
- POST
factor:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3"
hints:
allow:
- GET
- DELETE
UserFactorVerifyPushTransactionWaiting:
summary: WAITING
value:
expiresAt: 2015-04-01T15:57:32.000Z
factorResult: WAITING
profile:
credentialId: [email protected]
_links:
poll:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA"
hints:
allow:
- GET
cancel:
href: "https://{yourOktaDomain}/api/v1/users/00u15s1KDETTQMQYABRL/factors/opfh52xcuft3J4uZc0g3/transactions/v2mst.GldKV5VxTrifyeZmWSQguA"
hints:
allow:
- DELETE
UserFactorVerifySecurityQuestionRequest:
summary: security question verify
value:
answer: mayonnaise
UserFactorVerifySuccessSmsResponse:
summary: sms verify
value:
factorResult: SUCCESS
UserFactorVerifySuccessSqResponse:
summary: security question verify
value:
factorResult: SUCCESS
UserFactorVerifySuccessTokenResponse:
summary: token verify
value:
factorResult: SUCCESS
UserFactorVerifySuccessTotpResponse:
summary: totp verify
value:
factorResult: SUCCESS
UserFactorVerifySuccessYubikeyResponse:
summary: yubikey verify
value:
factorResult: SUCCESS
UserFactorVerifyU2fRequest:
summary: u2f verify
value:
clientData: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiS2NCLXRqUFU0NDY0ZThuVFBudXIiLCJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDozMDAwIiwiY2lkX3B1YmtleSI6InVudXNlZCJ9
signatureData: AQAAACYwRgIhAKPktdpH0T5mlPSm_9uGW5w-VaUy-LhI9tIacexpgItkAiEAncRVZURVPOq7zDwIw-OM5LtSkdAxOkfv0ZDVUx3UFHc
UserFactorVerifyU2fResponse:
summary: u2f verify response
value:
factorResult: SUCCESS
profile:
credentialId: h1bFwJFU9wnelYkexJuQfoUHZ5lX3CgQMTZk4H3I8kM9Nn6XALiQ-BIab4P5EE0GQrA7VD-kAwgnG950aXkhBw
version: U2F_V2
UserFactorVerifyWebauthnRequest:
summary: WebAuthn verify challenge (posts a signed assertion using the challenge
`nonce`)
value:
clientData: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZ2V0QXNzZXJ0aW9uIiwiY2hhbGxlbmdlIjoiS2NCLXRqUFU0NDY0ZThuVFBudXIiLCJvcmlnaW4iOiJodHRwczovL2xvY2FsaG9zdDozMDAwIiwiY2lkX3B1YmtleSI6InVudXNlZCJ9
authenticatorData: SBv04caJ+NLZ0bTeotGq9esMhHJ8YC5z4bMXXPbT95UFXbDsOg==
signatureData: AQAAACYwRgIhAKPktdpH0T5mlPSm_9uGW5w-VaUy-LhI9tIacexpgItkAiEAncRVZURVPOq7zDwIw-OM5LtSkdAxOkfv0ZDVUx3UFHc
UserFactorVerifyWebauthnResponse:
summary: WebAuthn verify
value:
factorResult: SUCCESS
profile:
credentialId: l3Br0n-7H3g047NqESqJynFtIgf3Ix9OfaRoNwLoloso99Xl2zS_O7EXUkmPeAIzTVtEL4dYjicJWBz7NpqhGA
authenticatorName: MacBook Touch ID
UserImportChangeAppUserProfileExample:
summary: Update an app user's profile response
value:
commands:
- type: com.okta.appUser.profile.update
value:
firstName: Stan
UserImportChangeUserProfileExample:
summary: Update an Okta user's profile response
value:
commands:
- type: com.okta.user.profile.update
value:
firstName: Stan
UserImportCreateANewUserExample:
summary: Create a new Okta user profile response
value:
commands:
- type: com.okta.action.update
value:
result: CREATE_USER
UserImportErrorExample:
summary: Return an error object
value:
error:
errorSummary: Error at third-party service. Please contact your admin.
UserImportMatchExample:
summary: Match an existing Okta user response
value:
commands:
- type: com.okta.action.update
value:
result: LINK_USER
- type: com.okta.user.update
value:
id: 00garwpuyxHaWOkdV0g3
UserImportPayloadExample:
summary: A sample Okta user import request
value:
source: cal7eyxOsnb20oWbZ0g4
eventId: JUGOUiYZTaKPmH6db0nDag
eventTime: 2019-02-27T20:59:04.000Z
eventTypeVersion: "1.0"
cloudEventVersion: "0.1"
eventType: com.okta.import.transform
contentType: application/json
data:
context:
conflicts:
- login
application:
name: test_app
id: 0oa7ey7aLRuBvcYUD0g4
label: Test App
status: ACTIVE
job:
id: ij17ez2AWtMZRfCZ60g4
type: import:users
matches: []
policy:
- EMAIL
- FIRST_AND_LAST_NAME
action:
result: CREATE_USER
appUser:
profile:
firstName: Sally2
lastName: Admin2
mobilePhone: null
accountType: PRO
secondEmail: null
failProvisioning: null
failDeprovisioning: null
externalId: user221
groups:
- [email protected]
- [email protected]
userName: administrator2
email: [email protected]
user:
profile:
lastName: Admin2
zipCode: null
city: null
secondEmail: null
postAddress: null
login: [email protected]
firstName: Sally2
primaryPhone: null
mobilePhone: null
streetAddress: null
countryCode: null
typeId: null
state: null
email: [email protected]
UserRiskNoneResponse:
summary: Example User Risk with NONE risk level response
value:
riskLevel: NONE
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/{userId}/risk"
hints:
allow:
- GET
- PUT
user:
href: "https://{yourOktaDomain}/api/v1/users/{userId}"
hints:
allow:
- GET
UserRiskRequest:
summary: Example upsert the risk for a user request
value:
riskLevel: HIGH
UserRiskResponse:
summary: Example User Risk response
value:
riskLevel: HIGH
reason: Admin override risk
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/{userId}/risk"
hints:
allow:
- GET
- PUT
user:
href: "https://{yourOktaDomain}/api/v1/users/{userId}"
hints:
allow:
- GET
UserSchemaAddRequest:
value:
definitions:
custom:
id: '#custom'
type: object
properties:
twitterUserName:
title: Twitter username
description: Twitter Username
type: string
required: false
minLength: 1
maxLength: 20
permissions:
- principal: SELF
action: READ_WRITE
required: []
UserSchemaResponse:
value:
id: "https://{yourOktaDomain}/meta/schemas/user/default"
$schema: http://json-schema.org/draft-04/schema#
name: user
title: Default Okta User
lastUpdated: 2015-09-05T10:40:45.000Z
created: 2015-02-02T10:27:36.000Z
definitions:
base:
id: '#base'
type: object
properties:
login:
title: Username
type: string
required: true
minLength: 5
maxLength: 100
permissions:
- principal: SELF
action: READ_WRITE
firstName:
title: First name
type: string
required: true
minLength: 1
maxLength: 50
permissions:
- principal: SELF
action: READ_WRITE
lastName:
title: Last name
type: string
required: true
minLength: 1
maxLength: 50
permissions:
- principal: SELF
action: READ_WRITE
email:
title: Primary email
type: string
required: true
format: email
permissions:
- principal: SELF
action: READ_WRITE
required:
- login
- firstName
- lastName
- email
custom:
id: '#custom'
type: object
properties:
twitterUserName:
title: Twitter username
description: User's username for twitter.com
type: string
required: false
minLength: 1
maxLength: 20
permissions:
- principal: SELF
action: READ_WRITE
required: []
type: object
properties:
profile:
allOf:
- $ref: '#/definitions/base'
- $ref: '#/definitions/custom'
VerifiedEmailDomainResponse:
value:
id: OeD114iNkrcN6aR680g4
validationStatus: VERIFIED
displayName: IT Admin
userName: noreply
domain: example.com
validationSubdomain: mail
dnsValidationRecords:
- recordType: TXT
fqdn: _oktaverification.example.com
verificationValue: 759080212bda43e3bc825a7d73b4bb64
- recordType: CNAME
fqdn: mail.example.com
verificationValue: u22224444.wl024.sendgrid.net
- recordType: CNAME
fqdn: t02._domainkey.example.com
verificationValue: t02.domainkey.u22224444.wl024.sendgrid.net
- recordType: CNAME
fqdn: t022._domainkey.example.com
verificationValue: t02.domainkey.u22224444.wl024.sendgrid.net
WSFederationEx:
summary: WS_FEDERATION
value:
name: template_wsfed
label: Sample WS-Fed App
signOnMode: WS_FEDERATION
settings:
app:
audienceRestriction: urn:example:app
groupValueFormat: windowsDomainQualifiedName
wReplyURL: https://example.com/
nameIDFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
siteURL: https://example.com
usernameAttribute: username
WSFederationPutEx:
summary: WS_FEDERATION
value:
name: template_wsfed
label: Sample WS-Fed App updated
signOnMode: WS_FEDERATION
settings:
app:
audienceRestriction: urn:exampleupdated:app
groupValueFormat: windowsDomainQualifiedName
wReplyURL: https://example.com/
nameIDFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
siteURL: https://example.com
usernameAttribute: username
WSFederationPutResponseEx:
summary: WS_FEDERATION
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
name: template_wsfed
label: Sample WS-Fed App updated
features: []
signOnMode: WS_FEDERATION
credentials:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
signing:
kid: FzJvvXtBHvs_-n70T4C2Rb2d64AyN4fqOme6piHOUKU
settings:
app:
groupFilter: null
siteURL: https://example.com
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
wReplyOverride: false
digestAlgorithm: SHA1
usernameAttribute: username
signatureAlgorithm: RSA_SHA1
audienceRestriction: urn:exampleupdated:app
wReplyURL: https://example.com/
groupName: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
attributeStatements: null
nameIDFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
realm: urn:okta:app:exkarjfNMKUjTmzTZ0g4
groupValueFormat: windowsDomainQualifiedName
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
WSFederationResponseEx:
summary: WS_FEDERATION
value:
id: 0oafxqCAJWWGELFTYASJ
status: ACTIVE
lastUpdated: 2023-01-21T14:11:24.000Z
created: 2023-01-21T14:11:24.000Z
accessibility:
selfService: false
errorRedirectUrl: null
loginRedirectUrl: null
_links:
uploadLogo:
href: "http://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/logo"
hints:
allow:
- POST
appLinks:
- name: customswaapp_link
href: "http://{yourOktaDomain}/home/{appName}/0oafxqCAJWWGELFTYASJ/aln5vjkW5oUmDGLMX0g4"
type: text/html
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/groups"
logo:
- name: medium
href: "http://{yourOktaDomain}/assets/img/logos/default.6770228fb0dab49a1695ef440a5279bb.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafxqCAJWWGELFTYASJ/lifecycle/deactivate"
visibility:
autoLaunch: false
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
name: template_wsfed
label: Sample WS-Fed App
features: []
signOnMode: WS_FEDERATION
credentials:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
signing:
kid: FzJvvXtBHvs_-n70T4C2Rb2d64AyN4fqOme6piHOUKU
settings:
app:
groupFilter: null
siteURL: https://example.com
authnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
wReplyOverride: false
digestAlgorithm: SHA1
usernameAttribute: username
signatureAlgorithm: RSA_SHA1
audienceRestriction: urn:example:app
wReplyURL: https://example.com/
groupName: http://schemas.microsoft.com/ws/2008/06/identity/claims/role
attributeStatements: null
nameIDFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
realm: urn:okta:app:exkarjfNMKUjTmzTZ0g4
groupValueFormat: windowsDomainQualifiedName
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
WellKnownAppAuthenticatorConfigurationCustomApp:
value:
- authenticatorId: aut22f6xzargnJZYE3l7
orgId: 00o1vhf34q20MfCFC3l7
type: app
key: custom_app
name: EnergyAus Authenticator
createdDate: 2022-10-11T08:56:45.000Z
lastUpdated: 2023-09-07T11:31:35.000Z
settings:
userVerification: PREFERRED
supportedMethods:
- type: push
status: ACTIVE
settings:
algorithms:
- RS256
- ES256
keyProtection: ANY
appAuthenticatorEnrollEndpoint: "https://{yourOktaDomain}/idp/myaccount/app-authenticators"
WellKnownOrgMetadataResponseClassic:
value:
id: 00o5rb5mt2H3d1TJd0h7
_links:
organization:
href: "https://{{yourOktaDomain}}"
pipeline: v1
settings:
analyticsCollectionEnabled: false
bugReportingEnabled: true
omEnabled: true
WellKnownOrgMetadataResponseCustomUrlOie:
value:
id: 00o47wwoytgsDqEtz0g7
_links:
organization:
href: "https://{yourSubdomain}.okta.com"
alternate:
href: "https://{yourCustomDomain}"
pipeline: idx
settings:
analyticsCollectionEnabled: false
bugReportingEnabled: true
omEnabled: false
activateOAuth2ClientSecretResponse:
summary: Activate Secret response example
value:
id: ocs2f50kZB0cITmYU0g4
status: ACTIVE
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
secret_hash: 0WOOvBSzV9clc4Nr7Rbaug
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
activeAPIServiceIntegrationInstanceSecretResponse:
summary: Activate Secret response example
value:
id: ocs2f50kZB0cITmYU0g4
status: ACTIVE
client_secret: '***MQGQ'
secret_hash: 0WOOvBSzV9clc4Nr7Rbaug
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/integrations/api/v1/api-services/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
bulkDeletePayload:
value:
entityType: USERS
profiles:
- externalId: EXT123456784C2IF
- externalId: EXT123456784C3IF
- externalId: EXT123456784C4IF
bulkUpsertPayload:
value:
entityType: USERS
profiles:
- externalId: EXT123456784C2IF
profile:
userName: [email protected]
firstName: Isaac
lastName: Brock
email: [email protected]
secondEmail: [email protected]
mobilePhone: 123-456-7890
homeAddress: "Kirkland, WA"
cloud-rule:
description: This global session policy uses a rule to challenge cloud users
summary: Global session policy - Challenge cloud users
value:
type: SIGN_ON
name: Challenge Cloud Users
conditions:
people:
users:
include: []
exclude: []
groups:
include: []
exclude: []
network:
connection: ZONE
include:
- 00u7yq5goxNFTiMjW1d7
authContext:
authType: ANY
actions:
signon:
access: ALLOW
requireFactor: true
factorPromptMode: ALWAYS
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
cloud-rule-response:
description: The response body from the creation of a global session policy
that uses a rule to challenge cloud users
summary: Global session policy - Challenge cloud users
value:
id: rule8jjozjGMGbHyC1d6
status: ACTIVE
type: SIGN_ON
name: Challenge Cloud Users
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
people:
users:
include: []
exclude: []
groups:
include: []
exclude: []
network:
connection: ZONE
include:
- 00u7yq5goxNFTiMjW1d7
authContext:
authType: ANY
risk:
behaviors: []
riskScore:
level: ANY
identityProvider:
provider: ANY
actions:
signon:
access: ALLOW
requireFactor: true
primaryFactor: PASSWORD_IDP_ANY_FACTOR
factorPromptMode: ALWAYS
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
create-auth-policy-rule-condition:
description: Creates an authentication policy rule with a conditions object.
summary: Authentication policy - Create rule with conditions
value:
system: false
type: ACCESS_POLICY
name: Rule with conditions
conditions:
userType:
include: []
exclude:
- otyezu4m0xN6w5JEa1d7
network:
connection: ZONE
exclude:
- 00u7yq5goxNFTiMjW1d7
riskScore:
level: ANY
people:
users:
exclude:
- 00u7yq5goxNFTiMjW1d7
include: []
groups:
include:
- 00g9i12jictsYdZdi1d7
exclude: []
platform:
include:
- type: MOBILE
os:
type: IOS
- type: MOBILE
os:
type: ANDROID
- type: DESKTOP
os:
type: MACOS
elCondition:
condition: security.risk.level == 'HIGH'
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
reauthenticateIn: PT2H
constraints:
- knowledge:
reauthenticateIn: PT2H
types:
- password
type: ASSURANCE
create-auth-policy-rule-condition-response:
description: The response body from the creation of an authentication policy
rule with conditions.
summary: Authentication policy - Policy rule with conditions
value:
id: rule8jjozjGMGbHyC1d6
status: ACTIVE
name: Rule with conditions
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
people:
users:
exclude:
- 00u7yq5goxNFTiMjW1d7
groups:
include:
- 00g9i12jictsYdZdi1d7
network:
connection: ZONE
exclude:
- nzo9o4rctwQCJNE6y1d7
platform:
include:
- type: MOBILE
os:
type: IOS
- type: MOBILE
os:
type: ANDROID
- type: DESKTOP
os:
type: MACOS
exclude: []
riskScore:
level: ANY
userType:
include: []
exclude:
- otyezu4m0xN6w5JEa1d7
elCondition:
condition: security.risk.level == 'HIGH'
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT2H
constraints:
knowledge:
required: true
types:
- password
reauthenticateIn: PT2H
type: ACCESS_POLICY
_links:
self:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
- DELETE
create-group-rule-request-example:
summary: Create group rule request example
value:
type: group_rule
name: Engineering group rule
conditions:
people:
users:
exclude:
- 00u22w79JPMEeeuLr0g4
groups:
exclude: []
expression:
value: user.role=="Engineer"
type: urn:okta:expression:1.0
actions:
assignUserToGroups:
groupIds:
- 00gjitX9HqABSoqTB0g3
create-user-in-group-request:
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
groupIds:
- 00g1emaKYZTWRYYRRTSK
- 00garwpuyxHaWOkdV0g4
create-user-in-group-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: STAGED
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: null
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
provider:
type: OKTA
name: OKTA
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-with-authentication-provider-request:
description: Set `activate` parameter to `true`
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
provider:
type: FEDERATION
name: FEDERATION
create-user-with-authentication-provider-response:
value:
id: 00uijntSwJjSHtDY70g3
status: ACTIVE
created: 2016-01-19T22:02:08.000Z
activated: 2016-01-19T22:02:08.000Z
statusChanged: 2016-01-19T22:02:08.000Z
lastLogin: null
lastUpdated: 2016-01-19T22:02:08.000Z
passwordChanged: null
profile:
login: [email protected]
firstName: Isaac
lastName: Brock
mobilePhone: 555-415-1337
email: [email protected]
secondEmail: null
credentials:
provider:
type: FEDERATION
name: FEDERATION
_links:
resetPassword:
href: "https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/lifecycle/reset_password"
method: POST
changeRecoveryQuestion:
href: "https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/credentials/change_recovery_question"
method: POST
deactivate:
href: "https://{yourOktaDomain}/api/v1/users/00uijntSwJjSHtDY70g3/lifecycle/deactivate"
method: POST
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-with-imported-hashed-password-request:
description: Set `activate` parameter to `true`
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password:
hash:
algorithm: BCRYPT
workFactor: 10
salt: rwh3vH166HCH/NT9XV5FYu
value: qaMqvAPULkbiQzkTCWo5XDcvzpk8Tna
create-user-with-imported-hashed-password-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: ACTIVE
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: 2013-07-02T21:36:25.344Z
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password: {}
provider:
type: IMPORT
name: IMPORT
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-with-non-default-user-type-request:
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
type:
id: otyfnjfba4ye7pgjB0g4
create-user-with-non-default-user-type-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: STAGED
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: null
type:
id: otyfnjfba4ye7pgjB0g4
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
provider:
type: OKTA
name: OKTA
_links:
schema:
href: "https://{yourOktaDomain}/api/v1/meta/schemas/user/oscfnjfba4ye7pgjB0g4"
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
type:
href: "https://{yourOktaDomain}/api/v1/meta/types/user/otyfnjfba4ye7pgjB0g4"
create-user-with-password-and-recovery-question-request:
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password:
value: tlpWENT2m
recovery_question:
question: Who is a major player in the cowboy scene?
answer: Annie Oakley
create-user-with-password-and-recovery-question-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: STAGED
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: 2013-07-02T21:36:25.344Z
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password: {}
recovery_question:
question: Who's a major player in the cowboy scene?
provider:
type: OKTA
name: OKTA
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-with-password-import-inline-hook-request:
description: Set `activate` parameter to `true`
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password:
hook:
type: default
create-user-with-password-import-inline-hook-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: ACTIVE
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: 2013-07-02T21:36:25.344Z
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password: {}
provider:
type: IMPORT
name: IMPORT
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-with-password-request:
description: Set `activate` parameter to `true`
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password:
value: tlpWENT2m
create-user-with-password-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: ACTIVE
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: 2013-07-02T21:36:25.344Z
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
password: {}
provider:
type: OKTA
name: OKTA
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-with-recovery-question-request:
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
recovery_question:
question: Who is a major player in the cowboy scene?
answer: Annie Oakley
create-user-with-recovery-question-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: STAGED
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: null
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
recovery_question:
question: Who's a major player in the cowboy scene?
provider:
type: OKTA
name: OKTA
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
create-user-without-credentials-request:
value:
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
create-user-without-credentials-response:
value:
id: 00ub0oNGTSWTBKOLGLNR
status: STAGED
created: 2013-07-02T21:36:25.344Z
activated: null
statusChanged: null
lastLogin: null
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: null
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
credentials:
provider:
type: OKTA
name: OKTA
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR/lifecycle/activate"
self:
href: "https://{yourOktaDomain}/api/v1/users/00ub0oNGTSWTBKOLGLNR"
createOAuth2ClientSecretCustomRequestBody:
summary: Add a user provided client secret
value:
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
status: ACTIVE
createOAuth2ClientSecretSystemGeneratedRequestBody:
summary: Add a system-generated client secret
value: {}
deactivateOAuth2ClientJsonWebKeyResponse:
summary: Deactivate JSON Web Key example
value:
id: pks2f50kZB0cITmYU0g4
kid: ASHJHGasa782333-Sla3x3POBiIxDreBCdZuFs5B
kty: RSA
alg: RS256
use: sig
e: AQAB
"n": AJncrzOrouIUCSMlRL0HU.....Kuine49_CEVR4GPn=
status: INACTIVE
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/activate"
hints:
allow:
- POST
deactivateOAuth2ClientSecretResponse:
summary: Deactivate Secret response example
value:
id: ocs2f4zrZbs8nUa7p0g4
status: INACTIVE
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
secret_hash: yk4SVx4sUWVJVbHt6M-UPA
created: 2023-02-21T20:08:24.000Z
lastUpdated: 2023-02-21T20:08:24.000Z
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate"
hints:
allow:
- POST
delete:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4"
hints:
allow:
- DELETE
deny-rule:
description: This global session policy uses a rule to deny users
summary: Global session policy - Deny users
value:
type: SIGN_ON
name: Deny users
conditions:
network:
connection: ANYWHERE
authContext:
authType: ANY
actions:
signon:
access: DENY
requireFactor: false
deny-rule-response:
description: The response body from the creation of a global session policy
that uses a rule to deny users
summary: Global session policy - Deny users
value:
id: rule8jjozjGMGbHyC1d6
status: ACTIVE
type: SIGN_ON
name: Deny
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
authContext:
authType: ANY
risk:
behaviors: []
riskScore:
level: ANY
identityProvider:
provider: ANY
actions:
signon:
access: DENY
requireFactor: false
primaryFactor: PASSWORD_IDP
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 120
maxSessionLifetimeMinutes: 0
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
editFeatureExample:
summary: Enable Okta Personal admin settings
value:
enableExportApps: true
enableEnduserEntryPoints: true
getBlockListExample:
summary: List of blocked email domains
value:
domains:
- yahoo.com
- google.com
group-example:
description: Example of a Group
summary: Group example
value:
id: 00g1emaKYZTWRYYRRTSK
created: 2015-02-06T10:11:28.000Z
lastUpdated: 2015-10-05T19:16:43.000Z
lastMembershipUpdated: 2015-11-28T19:15:32.000Z
objectClass:
- okta:user_group
type: OKTA_GROUP
profile:
name: West Coast Users
description: All Users West of The Rockies
_links:
logo:
- name: medium
href: "https://{yourOktaDomain}/img/logos/groups/okta-medium.png"
type: image/png
- name: large
href: "https://{yourOktaDomain}/img/logos/groups/okta-large.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/users"
apps:
href: "https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/apps"
group-rule-example:
description: Example of a group rule
summary: Group rule example
value:
type: group_rule
id: 0pr3f7zMZZHPgUoWO0g4
status: INACTIVE
name: Engineering group rule
created: 2016-12-01T14:40:04.000Z
lastUpdated: 2016-12-01T14:40:04.000Z
conditions:
people:
users:
exclude:
- 00u22w79JPMEeeuLr0g4
groups:
exclude: []
expression:
value: user.role=="Engineer"
type: urn:okta:expression:1.0
actions:
assignUserToGroups:
groupIds:
- 00gjitX9HqABSoqTB0g3
idp-discovery-dynamic-routing-rule:
description: This routing rule uses a dynamic Identity Provider.
summary: IdP discovery policy - Dynamic routing rule
value:
name: Dynamic routing rule
priority: 1
status: ACTIVE
conditions:
network:
connection: ANYWHERE
actions:
idp:
providers: []
idpSelectionType: DYNAMIC
matchCriteria:
- providerExpression: login.identifier.substringAfter('@')
propertyName: name
system: false
type: IDP_DISCOVERY
idp-discovery-dynamic-routing-rule-response:
summary: IdP discovery policy - Dynamic routing rule
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: Dynamic routing rule
priority: 1
status: ACTIVE
conditions:
network:
connection: ANYWHERE
actions:
idp:
providers: []
idpSelectionType: DYNAMIC
matchCriteria:
- providerExpression: login.identifier.substringAfter('@')
propertyName: name
system: false
type: IDP_DISCOVERY
idp-discovery-policy-response:
summary: IDP_DISCOVERY
value:
type: IDP_DISCOVERY
id: policyId
status: ACTIVE
name: Policy name
description: Policy description
priority: 1
system: true
created: createdDate
lastUpdated: lastUpdated
conditions: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}"
hints:
allow:
- GET
- PUT
rules:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules"
hints:
allow:
- POST
- GET
idp-discovery-specific-routing-rule:
description: This routing rule uses a specific Identity Provider.
summary: IdP discovery policy - Specific routing rule
value:
name: Specific routing rule
priority: 1
status: ACTIVE
conditions:
network:
connection: ANYWHERE
actions:
idp:
providers:
- type: GOOGLE
id: 0oa5ks3WmHLRh8Ivr0g4
idpSelectionType: SPECIFIC
system: false
type: IDP_DISCOVERY
idp-discovery-specific-routing-rule-response:
summary: IdP discovery policy - Specific routing rule
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: Specific routing rule
priority: 1
status: ACTIVE
conditions:
network:
connection: ANYWHERE
actions:
idp:
providers:
- type: GOOGLE
id: 0oa5ks3WmHLRh8Ivr0g4
idpSelectionType: SPECIFIC
system: false
type: IDP_DISCOVERY
inactiveAPIServiceIntegrationInstanceSecretResponse:
summary: Deactivate Secret response example
value:
id: ocs2f4zrZbs8nUa7p0g4
status: INACTIVE
client_secret: '***DhOW'
secret_hash: yk4SVx4sUWVJVbHt6M-UPA
created: 2023-02-21T20:08:24.000Z
lastUpdated: 2023-02-21T20:08:24.000Z
_links:
activate:
href: "https://{yourOktaDomain}/integrations/api/v1/api-services/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate"
hints:
allow:
- POST
delete:
href: "https://{yourOktaDomain}/integrations/api/v1/api-services/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4"
hints:
allow:
- DELETE
list-all-policy-rule-response-array:
description: List all policy rules response (Sign-on policy)
summary: List all policy rules response (Sign-on policy)
value:
- id: 0prh1sd28q5sXGW08697
status: ACTIVE
name: Test Sign-on policy
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
risk:
behaviors: []
riskScore:
level: ANY
identityProvider:
provider: ANY
actions:
signon:
requireFactor: false
factorPromptMode: ALWAYS
factorLifetime: 15
access: ALLOW
primaryFactor: PASSWORD_IDP_ANY_FACTOR
session:
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
usePersistentCookie: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- POST
type: SIGN_ON
list-apps-example:
description: List all apps example
summary: List apps example
value:
- id: 0oafwvZDWJKVLDCUWUAC
name: template_basic_auth
label: Sample Basic Auth App
status: ACTIVE
lastUpdated: 2013-09-30T00:56:52.000Z
created: 2013-09-30T00:56:52.000Z
accessibility:
selfService: false
errorRedirectUrl: null
visibility:
autoSubmitToolbar: false
hide:
iOS: false
web: false
appLinks:
login: true
features: []
signOnMode: BASIC_AUTH
credentials:
scheme: EDIT_USERNAME_AND_PASSWORD
userNameTemplate:
template: "${source.login}"
type: BUILT_IN
settings:
app:
url: https://example.com/login.html
authURL: https://example.com/auth.html
_links:
appLinks:
- href: "https://{yourOktaDomain}/home/template_basic_auth/0oafwvZDWJKVLDCUWUAC/1438"
name: login
type: text/html
users:
href: "https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/users"
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/lifecycle/deactivate"
groups:
href: "https://{yourOktaDomain}/api/v1/apps/0oafwvZDWJKVLDCUWUAC/groups"
list-group-rules-example:
description: List all group rules example
summary: List Group rules example
value:
- type: group_rule
id: 0pr3f7zMZZHPgUoWO0g4
status: INACTIVE
name: Engineering group rule
created: 2016-12-01T14:40:04.000Z
lastUpdated: 2016-12-01T14:40:04.000Z
conditions:
people:
users:
exclude:
- 00u22w79JPMEeeuLr0g4
groups:
exclude: []
expression:
value: user.role=="Engineer"
type: urn:okta:expression:1.0
actions:
assignUserToGroups:
groupIds:
- 00gjitX9HqABSoqTB0g3
list-groups-examples:
description: Lists an example of an OKTA_GROUP and an APP_GROUP
summary: List all groups example
value:
- id: 00g1emaKYZTWRYYRRTSK
created: 2015-02-06T10:11:28.000Z
lastUpdated: 2015-10-05T19:16:43.000Z
lastMembershipUpdated: 2015-11-28T19:15:32.000Z
objectClass:
- okta:user_group
type: OKTA_GROUP
profile:
name: West Coast Users
description: All Users West of The Rockies
_links:
logo:
- name: medium
href: "https://{yourOktaDomain}/img/logos/groups/okta-medium.png"
type: image/png
- name: large
href: "https://{yourOktaDomain}/img/logos/groups/okta-large.png"
type: image/png
users:
href: "https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/users"
apps:
href: "https://{yourOktaDomain}/api/v1/groups/00g1emaKYZTWRYYRRTSK/apps"
- id: 00garwpuyxHaWOkdV0g4
created: 2015-08-15T19:15:17.000Z
lastUpdated: 2015-11-18T04:02:19.000Z
lastMembershipUpdated: 2015-08-15T19:15:17.000Z
objectClass:
- okta:windows_security_principal
type: APP_GROUP
profile:
name: Engineering Users
description: corp.example.com/Engineering/Engineering Users
groupType: Security
samAccountName: Engineering Users
objectSid: S-1-5-21-717838489-685202119-709183397-1177
groupScope: Global
dn: "CN=Engineering Users,OU=Engineering,DC=corp,DC=example,DC=com"
windowsDomainQualifiedName: CORP\Engineering Users
externalId: OZJdWdONCU6h7WjQKp+LPA==
source:
id: 0oa2v0el0gP90aqjJ0g7
_links:
logo:
- name: medium
href: "https://{yourOktaDomain}/img/logos/groups/active_directory-medium.png"
type: image/png
- name: large
href: "https://{yourOktaDomain}/img/logos/groups/active_directory-large.png"
type: image/png
source:
href: "https://{yourOktaDomain}/api/v1/apps/0oa2v0el0gP90aqjJ0g7"
users:
href: "https://{yourOktaDomain}/api/v1/groups/00garwpuyxHaWOkdV0g4/users"
apps:
href: "https://{yourOktaDomain}/api/v1/groups/00garwpuyxHaWOkdV0g4/apps"
list-user-example:
value:
- id: 00u1f96ECLNVOKVMUSEA
status: ACTIVE
created: 2013-12-12T16:14:22.000Z
activated: 2013-12-12T16:14:22.000Z
statusChanged: 2013-12-12T22:14:22.000Z
lastLogin: 2013-12-12T22:14:22.000Z
lastUpdated: 2015-11-15T19:23:32.000Z
passwordChanged: 2013-12-12T22:14:22.000Z
profile:
firstName: Easy
lastName: E
email: [email protected]
login: [email protected]
mobilePhone: null
credentials:
password: {}
provider:
type: OKTA
name: OKTA
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u1f96ECLNVOKVMUSEA"
listStreamConfigurationExample:
summary: List of SSF Stream configurations example
value:
- aud: https://example.com
delivery:
method: urn:ietf:rfc:8935
endpoint_url: https://example.com
events_delivered:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
events_requested:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
events_supported:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
format: iss_sub
iss: "https://{yourOktaDomain}"
min_verification_interval: 0
stream_id: esc1k235GIIztAuGK0g5
mfa-enroll-policy-response:
summary: MFA_ENROLL
value:
type: MFA_ENROLL
id: policyId
status: ACTIVE
name: Policy name
description: Policy description
priority: 1
system: true
created: createdDate
lastUpdated: lastUpdated
conditions:
people:
groups:
include:
- groupId
settings:
factors:
okta_otp:
enroll:
self: OPTIONAL
consent:
type: NONE
okta_push:
enroll:
self: OPTIONAL
consent:
type: NONE
okta_password:
enroll:
self: OPTIONAL
consent:
type: NONE
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}"
hints:
allow:
- GET
- PUT
rules:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules"
hints:
allow:
- POST
- GET
newAPIServiceIntegrationInstanceSecretResponse:
summary: New secret response example
value:
id: ocs2f50kZB0cITmYU0g4
status: ACTIVE
client_secret: DRUFXGF9XbLnS9k-Sla3x3POBiIxDreBCdZuFs5B
secret_hash: FpCwXwSjTRQNtEI11I00-g
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/integrations/api/v1/api-services/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
oAuth2ClientSecretResponse:
summary: Client secret response example
value:
id: ocs2f50kZB0cITmYU0g4
status: ACTIVE
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
secret_hash: FpCwXwSjTRQNtEI11I00-g
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
oAuthClientJsonWebKey:
summary: JSON Web Key example
value:
id: pks2f50kZB0cITmYU0g4
kid: ASHJHGasa782333-Sla3x3POBiIxDreBCdZuFs5B
kty: RSA
alg: RS256
use: sig
e: AQAB
"n": AJncrzOrouIUCSMlRL0HU.....Kuine49_CEVR4GPn=
status: ACTIVE
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
oAuthClientJsonWebKeyListResponse:
summary: JSON Web Key list response example
value:
jwks:
keys:
- id: pks2f4zrZbs8nUa7p0g4
kid: DRUFXGF9XbLnS9k-Sla3x3POBiIxDreBCdZuFs5B
kty: RSA
alg: RS256
use: sig
e: AQAB
"n": AJncrKuine49_CEVR4GPn.....zOrouIUCSMlRL0HU=
status: INACTIVE
created: 2023-02-21T20:08:24.000Z
lastUpdated: 2023-02-21T20:08:24.000Z
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f4zrZbs8nUa7p0g4/lifecycle/activate"
hints:
allow:
- POST
delete:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f4zrZbs8nUa7p0g4"
hints:
allow:
- DELETE
- id: pks2f50kZB0cITmYU0g4
kid: ASHJHGasa782333-Sla3x3POBiIxDreBCdZuFs5B
kty: RSA
alg: RS256
use: sig
e: AQAB
"n": AJncrzOrouIUCSMlRL0HU.....Kuine49_CEVR4GPn=
status: ACTIVE
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/jwks/pks2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
oAuthClientJsonWebKeyRequest:
summary: JSON Web Key Request example
value:
id: pks2f50kZB0cITmYU0g4
kid: ASHJHGasa782333-Sla3x3POBiIxDreBCdZuFs5B
kty: RSA
alg: RS256
use: sig
e: AQAB
"n": AJncrzOrouIUCSMlRL0HU.....Kuine49_CEVR4GPn=
status: ACTIVE
oAuthClientSecretListResponse:
summary: Secrets list response example
value:
- id: ocs2f4zrZbs8nUa7p0g4
status: INACTIVE
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
secret_hash: yk4SVx4sUWVJVbHt6M-UPA
created: 2023-02-21T20:08:24.000Z
lastUpdated: 2023-02-21T20:08:24.000Z
_links:
activate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4/lifecycle/activate"
hints:
allow:
- POST
delete:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f4zrZbs8nUa7p0g4"
hints:
allow:
- DELETE
- id: ocs2f50kZB0cITmYU0g4
status: ACTIVE
client_secret: HAGDTYU9XbLnS......3xasFDDwecdZuFs5B
secret_hash: 0WOOvBSzV9clc4Nr7Rbaug
created: 2023-04-06T21:32:33.000Z
lastUpdated: 2023-04-06T21:32:33.000Z
_links:
deactivate:
href: "https://{yourOktaDomain}/api/v1/apps/0oa1nkheCuDn82XVI0g4/credentials/secrets/ocs2f50kZB0cITmYU0g4/lifecycle/deactivate"
hints:
allow:
- POST
oamp-id-proofing-policy-rule:
description: This account management policy rule enables ID proofing for enrollment
processes
summary: Account Management Policy - Account management policy rule with ID
proofing enabled
value:
id: ruleId
name: Account Management Policy Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
appSignOn:
access: ALLOW
verificationMethod:
id: entity_id
type: ID_PROOFING
oamp-id-proofing-policy-rule-response:
description: This account management policy rule response enables ID proofing
for enrollment processes
summary: Account Management Policy - Account management policy rule with ID
proofing enabled
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: Account Management Policy Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
appSignOn:
access: ALLOW
verificationMethod:
id: entity_id
type: ID_PROOFING
orgCommunicationOptInResponse:
summary: Opt in to communication emails
value:
optOutEmailUsers: false
_links:
optOut:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication/optOut"
hints:
allow:
- POST
orgCommunicationOptOutResponse:
summary: Opt out of communication emails
value:
optOutEmailUsers: true
_links:
optIn:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaCommunication/optIn"
hints:
allow:
- POST
orgContactTypeResponse:
summary: Org Contact Types
value:
- contactType: BILLING
_links:
billing:
href: "https://{yourOktaDomain}/api/v1/org/contacts/billing"
- contactType: TECHNICAL
_links:
technical:
href: "https://{yourOktaDomain}/api/v1/org/contacts/technical"
orgContactUserResponse:
summary: Contact User
value:
userId: 00ux3u0ujW1r5AfZC1d7
_links:
user:
href: "https://{yourOktaDomain}/api/v1/users/00ux3u0ujW1r5AfZC1d7"
orgHideFooterPrefResponse:
summary: Hide footer response
value:
showEndUserFooter: false
_links:
showEndUserFooter:
href: "https://{yourOktaDomain}/api/v1/org/preferences/showEndUserFooter"
hints:
allow:
- POST
orgShowFooterPrefResponse:
summary: Show footer response
value:
showEndUserFooter: true
_links:
hideEndUserFooter:
href: "https://{yourOktaDomain}/api/v1/org/preferences/hideEndUserFooter"
hints:
allow:
- POST
orgSupportSettingsResponse:
summary: Org Support Settings
value:
support: ENABLED
expiration: 2024-01-24T11:13:14.000Z
_links:
extend:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport/extend"
hints:
allow:
- POST
revoke:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport/revoke"
hints:
allow:
- POST
orgSupportSettingsRevokeResponse:
summary: Revoked Org Support
value:
support: DISABLED
expiration: null
_links:
grant:
href: "https://{yourOktaDomain}/api/v1/org/privacy/oktaSupport/grant"
hints:
allow:
- POST
password-policy-response:
summary: PASSWORD
value:
type: PASSWORD
id: policyId
status: ACTIVE
name: Policy name
description: Policy description
priority: 1
system: true
created: createdDate
lastUpdated: lastUpdated
conditions:
people:
groups:
include:
- groupId
authProvider:
provider: provider
settings:
password:
complexity:
minLength: 8
minLowerCase: 1
minUpperCase: 1
minNumber: null
minSymbol: 0
excludeUsername: true
dictionary:
common:
exclude: false
excludeAttributes: []
age:
maxAgeDays: 0
expireWarnDays: 0
minAgeMinutes: 0
historyCount: 4
lockout:
maxAttempts: 0
autoUnlockMinutes: 0
userLockoutNotificationChannels: []
showLockoutFailures: false
recovery:
factors:
recovery_question:
status: ACTIVE
properties:
complexity:
complexity: 4
okta_email:
status: ACTIVE
properties:
recoveryToken:
tokenLifetimeMinutes: 10080
okta_sms:
status: INACTIVE
okta_call:
status: INACTIVE
delegation:
options:
skipUnlock: false
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}"
hints:
allow:
- GET
- PUT
rules:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules"
hints:
allow:
- POST
- GET
policy-mapping-list-response:
summary: List all Mappings for a policy
value:
- id: policyId
_links:
application:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}"
hints:
allow:
- GET
- PUT
- DELETE
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings/{mappingId}"
hints:
allow:
- GET
- PUT
- DELETE
policy:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}"
hints:
allow:
- GET
- PUT
- DELETE
policy-mapping-response:
summary: Policy Mapping for a Policy
value:
id: policyId
_links:
application:
href: "https://{yourOktaDomain}/api/v1/apps/{appId}"
hints:
allow:
- GET
- PUT
- DELETE
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/mappings/{mappingId}"
hints:
allow:
- GET
- PUT
- DELETE
policy:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}"
hints:
allow:
- GET
- PUT
- DELETE
postAPIServiceIntegrationRequest:
value:
type: my_app_cie
grantedScopes:
- okta.logs.read
- okta.groups.read
- okta.users.read
postAPIServiceIntegrationResponse:
summary: Post response example
value:
id: 0oa72lrepvp4WqEET1d9
type: my_app_cie
name: My App Cloud Identity Engine
createdAt: 2023-02-21T20:08:24.000Z
createdBy: 00uu3u0ujW1P6AfZC2d5
clientSecret: CkF69kXtag0q0P4pXU8OnP5IAzgGlwx6eqGy7Fmg
configGuideUrl: "https://{docDomain}/my-app-cie/configuration-guide"
grantedScopes:
- okta.logs.read
- okta.groups.read
- okta.users.read
_links:
self:
href: "https://{yourOktaDomain}/integrations/api/v1/api-services/0oa72lrepvp4WqEET1d9"
hints:
allow:
- GET
- DELETE
client:
href: "https://{yourOktaDomain}/oauth2/v1/clients/0oa72lrepvp4WqEET1d9"
hints:
allow:
- GET
logo:
name: small
href: "https://{logoDomain}/{logoPath}/my_app_cie_small_logo"
profile-enrollment-policy-response:
summary: PROFILE_ENROLLMENT
value:
type: PROFILE_ENROLLMENT
id: policyId
status: ACTIVE
name: Policy name
description: Policy description
priority: 1
system: true
created: createdDate
lastUpdated: lastUpdated
conditions: null
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}"
hints:
allow:
- GET
- PUT
rules:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules"
hints:
allow:
- POST
- GET
radius-rule:
description: This global session policy uses a rule to challenge VPN users with
Radius
summary: Global session policy - Challenge VPN users with Radius
value:
type: SIGN_ON
status: ACTIVE
name: Challenge VPN users
conditions:
network:
connection: ANYWHERE
authContext:
authType: RADIUS
people:
users:
exclude: []
risk:
behaviors: []
riskScore:
level: ANY
identityProvider:
provider: ANY
actions:
signon:
access: ALLOW
requireFactor: true
primaryFactor: PASSWORD_IDP_ANY_FACTOR
factorPromptMode: ALWAYS
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
radius-rule-response:
description: The response body from the creation of a global session policy
that uses a rule to challenge VPN users with Radius
summary: Global session policy - Challenge VPN users with Radius
value:
id: rule8jjozjGMGbHyC1d6
status: ACTIVE
type: SIGN_ON
name: Challenge VPN users
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
network:
connection: ANYWHERE
authContext:
authType: RADIUS
actions:
signon:
access: ALLOW
requireFactor: true
factorPromptMode: ALWAYS
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
replace-user-request:
value:
credentials:
password:
value: tlpWENT2m
recovery_question:
question: Who's a major player in the cowboy scene?
answer: Annie Oakley
provider:
type: OKTA
name: OKTA
profile:
firstName: Isaac
lastName: Brock
email: [email protected]
login: [email protected]
mobilePhone: 555-415-1337
settingsResponseBaseEx:
value:
notifications:
vpn:
network:
connection: DISABLED
message: null
helpUrl: null
manualProvisioning: false
implicitAssignment: false
notes:
admin: null
enduser: null
sign-on-policy-rule:
description: Sign-on policy rule with a factor mode always
summary: Sign-on policy - Rule with factor mode always
value:
type: SIGN_ON
name: Test Sign On
conditions:
network:
connection: ANYWHERE
riskScore:
level: ANY
identityProvider:
provider: ANY
authContext:
authType: ANY
actions:
signon:
requireFactor: false
factorPromptMode: ALWAYS
factorLifetime: 15
access: ALLOW
session:
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
usePersistentCookie: false
primaryFactor: PASSWORD_IDP_ANY_FACTOR
sign-on-policy-rule-response:
description: Sign-on policy rule with a factor mode always
summary: Sign-on policy - Rule with factor mode always
value:
type: SIGN_ON
name: Test Sign On
id: 0prh1sd28q5sXGW08697
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
status: ACTIVE
conditions:
network:
connection: ANYWHERE
riskScore:
level: ANY
identityProvider:
provider: ANY
authContext:
authType: ANY
people:
users:
exclude: []
actions:
signon:
requireFactor: false
factorPromptMode: ALWAYS
factorLifetime: 15
access: ALLOW
session:
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
usePersistentCookie: false
primaryFactor: PASSWORD_IDP_ANY_FACTOR
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
skip-factor-challenge-on-prem-rule:
description: This global session policy uses a rule to skip factor challenge
for on-prem sign-in use
summary: Global session policy - Skip factor challenge for on-prem sign-in use
value:
type: SIGN_ON
status: ACTIVE
name: Skip Factor Challenge when On-Prem
conditions:
network:
connection: ZONE
include:
- 00u7yq5goxNFTiMjW1d7
authContext:
authType: ANY
actions:
signon:
access: ALLOW
requireFactor: false
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
skip-factor-challenge-on-prem-rule-response:
description: The response body from the creation of a global session policy
that uses a rule to skip the factor challenge for on-prem sign-in use
summary: Global session policy - Skip factor challenge for on-prem sign-in use
value:
id: rule8jjozjGMGbHyC1d6
status: ACTIVE
name: Skip Factor Challenge when On-Prem
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
network:
connection: ZONE
include:
- 00u7yq5goxNFTiMjW1d7
authContext:
authType: ANY
people:
users:
exclude: []
risk:
behaviors: []
riskScore:
level: ANY
identityProvider:
provider: ANY
actions:
signon:
access: ALLOW
requireFactor: false
primaryFactor: PASSWORD_IDP_ANY_FACTOR
rememberDeviceByDefault: false
session:
usePersistentCookie: false
maxSessionIdleMinutes: 720
maxSessionLifetimeMinutes: 0
type: SIGN_ON
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
sspr-enabled-OAMP:
description: This policy defers to the Okta account management policy to define
SSPR authentication requirements.
summary: Password policy - SSPR with Okta account management policy
value:
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
accessControl: AUTH_POLICY
primary:
methods:
- sms
- email
stepUp:
required: false
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-OAMP-response:
summary: Password policy - SSPR with access control set to Okta account management
policy
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
accessControl: AUTH_POLICY
primary:
methods:
- sms
- email
stepUp:
required: false
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-OAMP-update:
description: This policy defers to the Okta account management policy to define
SSPR authentication requirements.
summary: Password policy - SSPR with Okta account management policy
value:
id: ruleId
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
accessControl: AUTH_POLICY
primary:
methods:
- sms
- email
stepUp:
required: false
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-no-step-up:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Phone SMS or email are initial authenticators with no secondary\
\ authentication required."
summary: Password policy - SSPR with no step up
value:
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- sms
- email
stepUp:
required: false
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-no-step-up-response:
summary: Password policy - SSPR with no step up
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- sms
- email
stepUp:
required: false
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-no-step-up-update:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Phone SMS or email are initial authenticators with no secondary\
\ authentication required."
summary: Password policy - SSPR with no step up
value:
id: ruleId
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- sms
- email
stepUp:
required: false
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sq-step-up:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Phone SMS and Okta Verify push are the initial authenticators,\
\ and the secondary authentication is a security question."
summary: Password policy - SSPR with security question as step-up auth
value:
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
stepUp:
required: true
methods:
- security_question
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sq-step-up-response:
summary: Password policy - SSPR with security question as step up
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
stepUp:
required: true
methods:
- security_question
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sq-step-up-update:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Phone SMS and Okta Verify push are initial authenticators, and\
\ the secondary authentication is a security question."
summary: Password policy - SSPR with security question as step up
value:
id: ruleId
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
stepUp:
required: true
methods:
- security_question
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sso-step-up:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Phone SMS or email are initial authenticators. The step-up authentication\
\ required is any active SSO authenticator."
summary: Password policy - SSPR with any SSO authenticator as step up
value:
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
stepUp:
required: true
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sso-step-up-response:
summary: Password policy - SSPR with any SSO authenticator as step up
value:
id: ruleId
_links:
self:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
stepUp:
required: true
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sso-step-up-update:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Phone SMS or email are initial authenticators. The step-up authentication\
\ required is any active SSO authenticator."
summary: Password policy - SSPR with any SSO authenticator as step up
value:
id: ruleId
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
stepUp:
required: true
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sso-step-up-with-constraints:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Okta Verify push, Phone SMS, or Google OTP are initial authenticators.\
\ The secondary authentication required is any SSO authenticator. The `methodConstraints`\
\ property limits OTP authenticators to Google."
summary: Password policy - Enable SSPR with OTP enabled and Google authenticator
constraint
value:
id: ruleId
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
- otp
methodConstraints:
- method: otp
allowedAuthenticators:
- key: google_otp
stepUp:
required: true
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sso-step-up-with-constraints-response:
summary: Password policy - Enable SSPR with OTP enabled and Google authenticator
constraint
value:
id: ruleId
_links:
self:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}"
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: "https://{yourOktaDomain}/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
- otp
methodConstraints:
- method: otp
allowedAuthenticators:
- key: google_otp
stepUp:
required: true
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
sspr-enabled-sso-step-up-with-constraints-update:
description: "This password policy permits self-service password change, reset,\
\ and unlock. Okta Verify push, Phone SMS, or Google OTP are initial authenticators.\
\ The secondary authentication required is any SSO authenticator. The `methodConstraints`\
\ property limits OTP authenticators to Google."
summary: Password policy - Enable SSPR with OTP enabled and Google authenticator
constraint
value:
id: ruleId
name: SSPR Rule
priority: 1
status: ACTIVE
conditions:
people:
users:
exclude: []
network:
connection: ANYWHERE
actions:
passwordChange:
access: ALLOW
selfServicePasswordReset:
access: ALLOW
requirement:
primary:
methods:
- push
- sms
- otp
methodConstraints:
- method: otp
allowedAuthenticators:
- key: google_otp
stepUp:
required: true
selfServiceUnlock:
access: ALLOW
system: false
type: PASSWORD
streamConfigurationExample:
summary: SSF Stream configuration example
value:
aud: https://example.com
delivery:
method: urn:ietf:rfc:8935
endpoint_url: https://example.com
events_delivered:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
events_requested:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
events_supported:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
format: iss_sub
iss: "https://{yourOktaDomain}"
min_verification_interval: 0
stream_id: esc1k235GIIztAuGK0g5
twofa-enabled-disallow-password-allow-phishing:
description: This two-factor authentication policy uses a rule to disallow passwords
and require phishing resistance for possession authenticators for authentication.
summary: Authentication policy - 2FA with granular authentication
value:
name: Passwordless 2FA
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT0S
constraints:
knowledge:
excludedAuthenticationMethods:
key: okta_password
possession:
deviceBound: REQUIRED
phishingREsistant: REQUIRED
type: ACCESS_POLICY
twofa-enabled-disallow-password-allow-phishing-response:
description: The rule from a two-factor authentication policy that disallows
passwords and requires phishing resistance
summary: Authentication policy - 2FA with granular authentication
value:
id: rul7yut96gmsOzKAA1d6
status: ACTIVE
name: Passwordless 2FA
priority: 0
created: 2023-05-01T21:13:15.000Z
lastUpdated: 2023-05-01T21:13:15.000Z
system: false
conditions: null
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT0S
constraints:
knowledge:
excludedAuthenticationMethods:
key: okta_password
required: false
possession:
deviceBound: REQUIRED
phishingREsistant: REQUIRED
required: true
type: ACCESS_POLICY
_links:
self:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
twofa-enabled-post-auth-kmsi-disabled:
description: This two-factor authentication policy uses a rule that doesn't
prompt the user to stay signed in post-authentication.
summary: Authentication policy - 2FA with granular authentication (KMSI disabled)
value:
name: 2FA with Post Auth KMSI prompt disabled
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT2H
constraints:
knowledge:
excludedAuthenticationMethods:
key: okta_password
keepMeSignedIn:
postAuth: NOT_ALLOWED
type: ACCESS_POLICY
twofa-enabled-post-auth-kmsi-disabled-response:
description: This two-factor authentication policy uses a rule that doesn't
prompt the user to stay signed in post-authentication.
summary: Authentication policy - 2FA with granular authentication (KMSI disabled)
value:
id: rul7yut96gmsOzKAA1d6
status: ACTIVE
name: 2FA with Post Auth KMSI prompt disabled
priority: 0
created: 2023-05-01T21:13:15.000Z
lastUpdated: 2023-05-01T21:13:15.000Z
system: false
conditions: null
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT0S
constraints:
knowledge:
excludedAuthenticationMethods:
key: okta_password
required: true
keepMeSignedIn:
postAuth: NOT_ALLOWED
type: ACCESS_POLICY
_links:
self:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
twofa-enabled-post-auth-kmsi-enabled:
description: This two-factor authentication policy uses a rule to prompt the
user to stay signed in post authentication.
summary: Authentication policy - 2FA with granular authentication (KMSI enabled)
value:
name: 2FA with Post Auth KMSI prompt enabled
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT2H
constraints:
knowledge:
excludedAuthenticationMethods:
key: okta_password
keepMeSignedIn:
postAuth: ALLOWED
postAuthPromptFrequency: P30D
twofa-enabled-post-auth-kmsi-enabled-response:
description: This two-factor authentication policy uses a rule to prompt the
user to stay signed in post authentication.
summary: Authentication policy - 2FA with granular authentication (KMSI enabled)
value:
id: rul7yut96gmsOzKAA1d6
status: ACTIVE
name: 2FA with Post Auth KMSI prompt enabled
priority: 0
created: 2023-05-01T21:13:15.000Z
lastUpdated: 2023-05-01T21:13:15.000Z
system: false
conditions: null
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT0S
constraints:
knowledge:
excludedAuthenticationMethods:
key: okta_password
required: true
keepMeSignedIn:
postAuth: ALLOWED
postAuthPromptFrequency: PT720H
type: ACCESS_POLICY
_links:
self:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
deactivate:
href: "https://sampleorg.okta.com/api/v1/policies/{policyId}/rules/{ruleId}/lifecycle/deactivate"
hints:
allow:
- POST
update-auth-policy-rule-condition:
description: Updates the conditions object on the request body of an authentication
policy rule.
summary: Authentication policy - Update rule with conditions
value:
type: ACCESS_POLICY
name: Rule with conditions - exclude a group
description: Updated policy rule
conditions:
userType:
include: []
exclude:
- otyezu4m0xN6w5JEa1d7
network:
connection: ZONE
exclude:
- nzo9o4rctwQCJNE6y1d7
riskScore:
level: ANY
people:
users:
exclude:
- 00u7yq5goxNFTiMjW1d7
include: []
groups:
include: []
exclude:
- 00g8vta8qzkxPEfKC1d7
platform:
include:
- type: MOBILE
os:
type: IOS
- type: MOBILE
os:
type: ANDROID
- type: DESKTOP
os:
type: MACOS
elCondition:
condition: security.risk.level == 'HIGH'
update-auth-policy-rule-condition-response:
description: The response body from an updated conditions object of an authentication
policy rule.
summary: Authentication policy - Update rule with conditions
value:
id: rulezuo73ySrHndLb1d7
status: ACTIVE
name: Rule with conditions - exclude a group
priority: 0
created: 2024-04-25T17:35:02.000Z
lastUpdated: 2024-04-25T17:35:02.000Z
system: false
conditions:
people:
users:
exclude: []
groups:
exclude:
- 00u7yq5goxNFTiMjW1d7
network:
connection: ZONE
exclude:
- nzo9o4rctwQCJNE6y1d7
platform:
include:
- type: MOBILE
os:
type: IOS
- type: MOBILE
os:
type: ANDROID
- type: DESKTOP
os:
type: MACOS
exclude: []
riskScore:
level: ANY
userType:
include: []
exclude:
- otyezu4m0xN6w5JEa1d7
elCondition:
condition: security.risk.level == 'HIGH'
actions:
appSignOn:
access: ALLOW
verificationMethod:
factorMode: 2FA
type: ASSURANCE
reauthenticateIn: PT2H
constraints:
knowledge:
required: true
types:
- password
reauthenticateIn: PT2H
type: ACCESS_POLICY
_links:
self:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
- DELETE
deactivate:
href: https://sampleorg.okta.com/api/v1/policies/rst7xus97faIAgmti1d7/rules/rul7yut96gmsOzKAA1d6
hints:
allow:
- GET
- PUT
- DELETE
update-user-profile-request:
value:
profile:
firstName: Isaac
email: [email protected]
mobilePhone: 555-415-1337
update-user-set-password-request:
value:
credentials:
password:
value: "uTVM,TPw55"
update-user-set-recovery-question-and-answer:
value:
credentials:
recovery_question:
question: How many roads must a man walk down?
answer: forty two
user-example:
summary: User example
value:
id: 00ub0oNGTSWTBKOLGLNR
status: ACTIVE
created: 2013-06-24T16:39:18.000Z
activated: 2013-06-24T16:39:19.000Z
statusChanged: 2013-06-24T16:39:19.000Z
lastLogin: 2013-06-24T17:39:19.000Z
lastUpdated: 2013-07-02T21:36:25.344Z
passwordChanged: 2013-07-02T21:36:25.344Z
profile:
login: [email protected]
firstName: Isaac
lastName: Brock
nickName: issac
displayName: Isaac Brock
email: [email protected]
secondEmail: [email protected]
profileUrl: http://www.example.com/profile
preferredLanguage: en-US
userType: Employee
organization: Okta
title: Director
division: R&D
department: Engineering
costCenter: "10"
employeeNumber: "187"
mobilePhone: +1-555-415-1337
primaryPhone: +1-555-514-1337
streetAddress: 301 Brannan St.
city: San Francisco
state: CA
zipCode: "94107"
countryCode: US
credentials:
password: {}
recovery_question:
question: What's my childhood elementary school?
provider:
type: OKTA
name: OKTA
_links:
self:
href: "https://{yourOktaDomain}/api/v1/users/00u1f96ECLNVOKVMUSEA"
userNameTemplateResponseBaseEx:
value:
userNameTemplate:
template: "${source.email}"
type: BUILT_IN
wellKnownSSFMetadataExample:
summary: Well-Known SSF Metadata example
value:
configuration_endpoint: "https://{yourOktaDomain}/api/v1/ssf/stream"
delivery_methods_supported:
- https://schemas.openid.net/secevent/risc/delivery-method/push
- urn:ietf:rfc:8935
issuer: "https://{yourOktaDomain}"
jwks_uri: "https://{yourOktaDomain}/oauth2/v1/keys"
parameters:
OktaResponse:
description: |-
Specifies the media type of the resource. Optional `okta-response` value can be included for performance optimization.
Complex DelAuth configurations may degrade performance when fetching specific parts of the response, and passing this parameter can omit these parts, bypassing the bottleneck.
Enum values for `okta-response`:
* `omitCredentials`: Omits the credentials subobject from the response.
* `omitCredentialsLinks`: Omits the following HAL links from the response: Change Password, Change Recovery Question, Forgot Password, Reset Password, Reset Factors, Unlock.
* `omitTransitioningToStatus`: Omits the `transitioningToStatus` field from the response.
examples:
Omit credentials subobject and credentials links:
summary: Omits the credentials subobject and credentials links from the
response. Does not apply performance optimization.
value: "application/json; okta-response=omitCredentials,omitCredentialsLinks"
Omit credentials, credentials links, and `transitioningToStatus` field:
summary: "Omits the credentials, credentials links, and `transitioningToStatus`\
\ field from the response. Applies performance optimization."
value: "application/json; okta-response=\"omitCredentials,omitCredentialsLinks,\
\ omitTransitioningToStatus\""
explode: false
in: header
name: Content-Type
required: false
schema:
type: string
style: simple
UISchemaId:
description: The unique ID of the UI Schema
explode: false
in: path
name: id
required: true
schema:
example: uis4a7liocgcRgcxZ0g7
type: string
style: simple
appInstanceId:
description: ID of the AD AppInstance in Okta
explode: false
in: path
name: appInstanceId
required: true
schema:
type: string
style: simple
assignmentId:
description: '`id` of the Realm Assignment'
explode: false
in: path
name: assignmentId
required: true
schema:
example: rul2jy7jLUlnO3ng00g4
type: string
style: simple
authenticatorEnrollmentId:
description: ID for a WebAuthn Preregistration Factor in Okta
explode: false
in: path
name: authenticatorEnrollmentId
required: true
schema:
type: string
style: simple
domain:
description: The okta domain name of your org or one of your custom domains
explode: false
in: path
name: domain
required: true
schema:
type: string
style: simple
limitParameter:
description: "Defines the number of policy rules returned. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: limit
required: false
schema:
type: string
style: form
pathApiServiceId:
description: '`id` of the API Service Integration instance'
example: 000lr2rLjZ6NsGn1P0g3
explode: false
in: path
name: apiServiceId
required: true
schema:
type: string
style: simple
pathApiTokenId:
description: id of the API Token
explode: false
in: path
name: apiTokenId
required: true
schema:
example: 00Tabcdefg1234567890
type: string
style: simple
pathAppId:
description: Application ID
explode: false
in: path
name: appId
required: true
schema:
example: 0oafxqCAJWWGELFTYASJ
type: string
style: simple
pathAppName:
description: Application name for the app type
explode: false
in: path
name: appName
required: true
schema:
example: oidc_client
type: string
style: simple
pathAppUserId:
description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00u13okQOVWZJGDOAUVR
type: string
style: simple
pathAssociatedServerId:
description: '`id` of the associated Authorization Server'
explode: false
in: path
name: associatedServerId
required: true
schema:
example: aus6xt9jKPmCyn6kg0g4
type: string
style: simple
pathAuthServerId:
description: '`id` of the Authorization Server'
explode: false
in: path
name: authServerId
required: true
schema:
example: GeGRTEr7f3yu2n7grw22
type: string
style: simple
pathAuthenticatorId:
description: '`id` of the Authenticator'
explode: false
in: path
name: authenticatorId
required: true
schema:
example: aut1nd8PQhGcQtSxB0g4
type: string
style: simple
pathBehaviorId:
description: id of the Behavior Detection Rule
explode: false
in: path
name: behaviorId
required: true
schema:
example: abcd1234
type: string
style: simple
pathBrandId:
description: The ID of the brand
explode: false
in: path
name: brandId
required: true
schema:
type: string
style: simple
pathBundleId:
description: The `id` of a bundle
explode: false
in: path
name: bundleId
required: true
schema:
example: 08ab2db568c7c300079fefd0
type: string
style: simple
pathCaptchaId:
description: The unique key used to identify your CAPTCHA instance
explode: false
in: path
name: captchaId
required: true
schema:
type: string
style: simple
pathClaimId:
description: '`id` of Claim'
explode: false
in: path
name: claimId
required: true
schema:
example: hNJ3Uk76xLagWkGx5W3N
type: string
style: simple
pathClientId:
description: '`client_id` of the app'
explode: false
in: path
name: clientId
required: true
schema:
example: 52Uy4BUWVBOjFItcg2jWsmnd83Ad8dD
type: string
style: simple
pathClientSecretId:
description: Unique `id` of the OAuth 2.0 Client Secret
example: ocs2f4zrZbs8nUa7p0g4
explode: false
in: path
name: secretId
required: true
schema:
type: string
style: simple
pathContactType:
explode: false
in: path
name: contactType
required: true
schema:
description: Type of contact
enum:
- BILLING
- TECHNICAL
example: BILLING
type: string
style: simple
pathCredentialKeyId:
description: '`id` of the certificate key'
explode: false
in: path
name: keyId
required: true
schema:
example: P7jXpG-LG2ObNgY9C0Mn2uf4InCQTmRZMDCZoVNxdrk
type: string
style: simple
pathCsrId:
description: '`id` of the CSR'
explode: false
in: path
name: csrId
required: true
schema:
example: fd7x1h7uTcZFx22rU1f7
type: string
style: simple
pathCustomizationId:
description: The ID of the email customization
explode: false
in: path
name: customizationId
required: true
schema:
type: string
style: simple
pathDeviceAssuranceId:
description: Id of the Device Assurance Policy
explode: false
in: path
name: deviceAssuranceId
required: true
schema:
type: string
style: simple
pathDeviceCheckId:
description: Id of the Device Check
explode: false
in: path
name: deviceCheckId
required: true
schema:
type: string
style: simple
pathDeviceId:
description: '`id` of the device'
explode: false
in: path
name: deviceId
required: true
schema:
example: guo4a5u7JHHhjXrMK0g4
type: string
style: simple
pathDomainId:
description: '`id` of the Domain'
explode: false
in: path
name: domainId
required: true
schema:
example: OmWNeywfTzElSLOBMZsL
type: string
style: simple
pathEmailDomainId:
explode: false
in: path
name: emailDomainId
required: true
schema:
description: The ID of the email domain.
type: string
style: simple
pathEmailServerId:
explode: false
in: path
name: emailServerId
required: true
schema:
description: ID of your SMTP Server configuration
type: string
style: simple
pathEntitlementId:
description: The `id` of a bundle entitlement
explode: false
in: path
name: entitlementId
required: true
schema:
example: 0obfxqCAJWWGELFTYASJ
type: string
style: simple
pathEventHookId:
description: '`id` of the Event Hook'
explode: false
in: path
name: eventHookId
required: true
schema:
example: who8vt36qfNpCGz9H1e6
type: string
style: simple
pathFactorId:
description: ID of an existing user Factor
explode: false
in: path
name: factorId
required: true
schema:
example: zAgrsaBe0wVGRugDYtdv
type: string
style: simple
pathFeatureId:
description: '`id` of the feature'
explode: false
in: path
name: featureId
required: true
schema:
example: R5HjqNn1pEqWGy48E9jg
type: string
style: simple
pathFeatureName:
description: Name of the Feature
explode: false
in: path
name: featureName
required: true
schema:
$ref: '#/components/schemas/ApplicationFeatureType'
style: simple
pathFirstPartyAppName:
description: |
The key name for the Okta app.
Supported apps:
* Okta Admin Console (`admin-console`)
explode: false
in: path
name: appName
required: true
schema:
example: admin-console
type: string
style: simple
pathGrantId:
description: Grant ID
explode: false
in: path
name: grantId
required: true
schema:
example: iJoqkwx50mrgX4T9LcaH
type: string
style: simple
pathGroupId:
description: The `id` of the group
explode: false
in: path
name: groupId
required: true
schema:
example: 00g1emaKYZTWRYYRRTSK
type: string
style: simple
pathGroupRuleId:
description: The `id` of the group rule
explode: false
in: path
name: groupRuleId
required: true
schema:
example: 0pr3f7zMZZHPgUoWO0g4
type: string
style: simple
pathHookKeyId:
description: ID of the Hook Key
explode: false
in: path
name: id
required: true
schema:
example: XreKU5laGwBkjOTehusG
type: string
style: simple
pathId:
description: "`id`, `login`, or `login shortname` (as long as it is unambiguous)\
\ of user"
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
pathIdentitySourceId:
description: The ID of the Identity Source for which the session is created
example: 0oa3l6l6WK6h0R0QW0g4
explode: false
in: path
name: identitySourceId
required: true
schema:
type: string
style: simple
pathIdentitySourceSessionId:
description: The ID of the Identity Source Session
example: aps1qqonvr2SZv6o70h8
explode: false
in: path
name: sessionId
required: true
schema:
type: string
style: simple
pathIdpCsrId:
description: '`id` of the IdP CSR'
explode: false
in: path
name: idpCsrId
required: true
schema:
example: 1uEhyE65oV3H6KM9gYcN
type: string
style: simple
pathIdpId:
description: '`id` of IdP'
explode: false
in: path
name: idpId
required: true
schema:
example: 0oa62bfdjnK55Z5x80h7
type: string
style: simple
pathInlineHookId:
description: '`id` of the Inline Hook'
explode: false
in: path
name: inlineHookId
required: true
schema:
example: Y7Rzrd4g4xj6WdKzrBHH
type: string
style: simple
pathJsonWebKeyId:
description: Unique `id` of the OAuth 2.0 Client JSON Web Key
example: pks2f4zrZbs8nUa7p0g4
explode: false
in: path
name: keyId
required: true
schema:
type: string
style: simple
pathKeyId:
description: ID of the Key Credential for the application
explode: false
in: path
name: keyId
required: true
schema:
example: sjP9eiETijYz110VkhHN
type: string
style: simple
pathKid:
description: Unique `id` of the IdP Key Credential
explode: false
in: path
name: kid
required: true
schema:
example: KmMo85SSsU7TZzOShcGb
type: string
style: simple
pathLifecycle:
description: Whether to `ENABLE` or `DISABLE` the feature
explode: false
in: path
name: lifecycle
required: true
schema:
$ref: '#/components/schemas/FeatureLifecycle'
style: simple
pathLinkedObjectName:
description: Primary or Associated name
explode: false
in: path
name: linkedObjectName
required: true
schema:
type: string
style: simple
pathLogStreamId:
description: Unique identifier for the Log Stream
explode: false
in: path
name: logStreamId
required: true
schema:
example: 0oa1orzg0CHSgPcjZ0g4
type: string
style: simple
pathLogStreamType:
explode: false
in: path
name: logStreamType
required: true
schema:
$ref: '#/components/schemas/LogStreamType'
style: simple
pathMappingId:
description: '`id` of the Mapping'
explode: false
in: path
name: mappingId
required: true
schema:
example: cB6u7X8mptebWkffatKA
type: string
style: simple
pathMemberId:
description: '`id` of the Member'
explode: false
in: path
name: memberId
required: true
schema:
example: irb1qe6PGuMc7Oh8N0g4
type: string
style: simple
pathMethodType:
description: Type of authenticator method
explode: false
in: path
name: methodType
required: true
schema:
$ref: '#/components/schemas/AuthenticatorMethodType'
style: simple
pathNotificationType:
explode: false
in: path
name: notificationType
required: true
schema:
$ref: '#/components/schemas/NotificationType'
style: simple
pathOAuthProvisioningAppName:
explode: false
in: path
name: appName
required: true
schema:
$ref: '#/components/schemas/OAuthProvisioningEnabledApp'
style: simple
pathOperation:
explode: false
in: path
name: operation
required: true
schema:
type: string
style: simple
pathOwnerId:
description: The `id` of the group owner
explode: false
in: path
name: ownerId
required: true
schema:
example: 00u1emaK22TWRYd3TtG
type: string
style: simple
pathPermissionType:
description: An okta permission type
explode: false
in: path
name: permissionType
required: true
schema:
example: okta.users.manage
type: string
style: simple
pathPolicyId:
description: '`id` of the Policy'
explode: false
in: path
name: policyId
required: true
schema:
example: 00plrilJ7jZ66Gn0X0g3
type: string
style: simple
pathPolicyMappingId:
description: '`id` of the policy resource Mapping'
explode: false
in: path
name: mappingId
required: true
schema:
example: maplr2rLjZ6NsGn1P0g3
type: string
style: simple
pathPoolId:
description: Id of the agent pool for which the settings will apply
explode: false
in: path
name: poolId
required: true
schema:
type: string
style: simple
pathPrimaryRelationshipName:
description: Name of the `primary` relationship being assigned
explode: false
in: path
name: primaryRelationshipName
required: true
schema:
example: manager
type: string
style: simple
pathPrimaryUserId:
description: User ID to be assigned to the `primary` relationship for the `associated`
user
explode: false
in: path
name: primaryUserId
required: true
schema:
type: string
style: simple
pathPrincipalRateLimitId:
description: id of the Principal Rate Limit
explode: false
in: path
name: principalRateLimitId
required: true
schema:
example: abcd1234
type: string
style: simple
pathPublicKeyId:
description: id" of the Public Key
explode: false
in: path
name: keyId
required: true
schema:
example: FcH2P9Eg7wr0o8N2FuV0
type: string
style: simple
pathPushProviderId:
description: Id of the push provider
explode: false
in: path
name: pushProviderId
required: true
schema:
type: string
style: simple
pathQueryRoleExpand:
description: "An optional parameter used to return targets configured for the\
\ standard Role Assignment in the `embedded` property. Supported values: `targets/groups`\
\ or `targets/catalog/apps`"
examples:
groupTarget:
summary: Return Group targets
value: targets/groups
appTarget:
summary: Return App targets
value: targets/catalog/apps
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
pathRealmId:
description: '`id` of the Realm'
explode: false
in: path
name: realmId
required: true
schema:
example: vvrcFogtKCrK9aYq3fgV
type: string
style: simple
pathRelationshipName:
description: Name of the `primary` or `associated` relationship being queried
examples:
manager:
summary: Example of a `primary` name
value: manager
subordinate:
summary: Example of an `associated` name
value: subordinate
explode: false
in: path
name: relationshipName
required: true
schema:
type: string
style: simple
pathResourceId:
description: '`id` of the Resource'
explode: false
in: path
name: resourceId
required: true
schema:
example: ire106sQKoHoXXsAe0g4
type: string
style: simple
pathResourceSelectorId:
description: '`id` of a Resource Selector'
explode: false
in: path
name: resourceSelectorId
required: true
schema:
example: rsl1hx31gVEa6x10v0g5
type: string
style: simple
pathResourceSetIdOrLabel:
description: '`id` or `label` the Resource Set'
explode: false
in: path
name: resourceSetIdOrLabel
required: true
schema:
example: iamoJDFKaJxGIr0oamd9g
type: string
style: simple
pathRiskProviderId:
description: '`id` of the Risk Provider object'
explode: false
in: path
name: riskProviderId
required: true
schema:
example: 00rp12r4skkjkjgsn
type: string
style: simple
pathRoleAssignmentId:
description: The `id` of the Role Assignment
explode: false
in: path
name: roleAssignmentId
required: true
schema:
example: JBCUYUC7IRCVGS27IFCE2SKO
type: string
style: simple
pathRoleId:
description: '`id` of the Role'
explode: false
in: path
name: roleId
required: true
schema:
example: 3Vg1Pjp3qzw4qcCK5EdO
type: string
style: simple
pathRoleIdOrLabel:
description: '`id` or `label` of the Role'
explode: false
in: path
name: roleIdOrLabel
required: true
schema:
example: cr0Yq6IJxGIr0ouum0g3
type: string
style: simple
pathRoleRef:
description: "A reference to an existing role. Standard roles require a `roleType`,\
\ while Custom Roles require a `roleId`. See [Standard Roles](/openapi/okta-management/guides/roles/#standard-roles)."
explode: false
in: path
name: roleRef
required: true
schema:
$ref: '#/components/schemas/listSubscriptionsRole_roleRef_parameter'
style: simple
pathRuleId:
description: '`id` of the Policy Rule'
explode: false
in: path
name: ruleId
required: true
schema:
example: ruld3hJ7jZh4fn0st0g3
type: string
style: simple
pathSchemaId:
explode: false
in: path
name: schemaId
required: true
schema:
type: string
style: simple
pathScopeId:
description: '`id` of Scope'
explode: false
in: path
name: scopeId
required: true
schema:
example: 0TMRpCWXRKFjP7HiPFNM
type: string
style: simple
pathSecretId:
description: '`id` of the API Service Integration instance Secret'
example: ocs2f4zrZbs8nUa7p0g4
explode: false
in: path
name: secretId
required: true
schema:
type: string
style: simple
pathSection:
explode: false
in: path
name: section
required: true
schema:
type: string
style: simple
pathSecurityEventProviderId:
description: '`id` of the Security Events Provider instance'
explode: false
in: path
name: securityEventProviderId
required: true
schema:
example: sse1qg25RpusjUP6m0g5
type: string
style: simple
pathSessionId:
description: '`id` of the Session'
explode: false
in: path
name: sessionId
required: true
schema:
example: l7FbDVqS8zHSy65uJD85
type: string
style: simple
pathSubmissionId:
description: OIN Integration ID
explode: false
in: path
name: submissionId
required: true
schema:
example: acme_submissionapp_1
type: string
style: simple
pathTargetGroupId:
explode: false
in: path
name: targetGroupId
required: true
schema:
example: 00g1e9dfjHeLAsdX983d
type: string
style: simple
pathTemplateId:
description: '`id` of the Template'
explode: false
in: path
name: templateId
required: true
schema:
example: 6NQUJ5yR3bpgEiYmq8IC
type: string
style: simple
pathTemplateName:
description: The name of the email template
explode: false
in: path
name: templateName
required: true
schema:
type: string
style: simple
pathThemeId:
description: The ID of the theme
explode: false
in: path
name: themeId
required: true
schema:
type: string
style: simple
pathTokenId:
description: '`id` of Token'
explode: false
in: path
name: tokenId
required: true
schema:
example: sHHSth53yJAyNSTQKDJZ
type: string
style: simple
pathTransactionId:
description: ID of an existing Factor verification transaction
explode: false
in: path
name: transactionId
required: true
schema:
example: gPAQcN3NDjSGOCAeG2Jv
type: string
style: simple
pathTrustedOriginId:
description: '`id` of the Trusted Origin'
explode: false
in: path
name: trustedOriginId
required: true
schema:
example: 7j2PkU1nyNIDe26ZNufR
type: string
style: simple
pathTypeId:
explode: false
in: path
name: typeId
required: true
schema:
description: The unique key for the User Type
type: string
style: simple
pathUpdateId:
description: Id of the update
explode: false
in: path
name: updateId
required: true
schema:
type: string
style: simple
pathUserId:
description: ID of an existing Okta user
explode: false
in: path
name: userId
required: true
schema:
example: 00ub0oNGTSWTBKOLGLNR
type: string
style: simple
pathUserIdOrLogin:
description: |-
If for the `self` link, the ID of the User for whom you want to get the primary User ID. If for the `associated` relation, the User ID or login value of the User assigned the associated relationship.
This can be `me` to represent the current session User.
examples:
manager:
summary: Example ID of `primary`
value: 00u5zex6ztMbOZhF50h7
subordinate:
summary: Example ID of `associated`
value: 00u5zex6ztMbOZhF50h7
explode: false
in: path
name: userIdOrLogin
required: true
schema:
type: string
style: simple
pathZoneId:
description: '`id` of the Network Zone'
example: nzowc1U5Jh5xuAK0o0g3
explode: false
in: path
name: zoneId
required: true
schema:
type: string
style: simple
privilegedAccountId:
description: ID of an existing Privileged Account
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
privilegedResourceId:
description: ID of an existing privileged resource
explode: false
in: path
name: id
required: true
schema:
type: string
style: simple
queryAfter:
description: "The cursor to use for pagination. It is an opaque string that\
\ specifies your current location in the list and is obtained from the `Link`\
\ response header. See [Pagination](https://developer.okta.com/docs/api/#pagination)."
explode: true
in: query
name: after
required: false
schema:
type: string
style: form
queryAppAfter:
description: "Specifies the pagination cursor for the next page of results.\
\ Treat this as an opaque value obtained through the next link relationship.\
\ See [Pagination](/#pagination)."
explode: true
in: query
name: after
required: false
schema:
example: "16275000448691"
type: string
style: form
queryAppGrantsExpand:
description: "An optional parameter to return scope details in the `_embedded`\
\ property. Valid value: `scope`"
explode: true
in: query
name: expand
required: false
schema:
example: scope
type: string
style: form
queryAppLimit:
description: |
Specifies the number of objects to return per page.
If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it).
See [Pagination](/#pagination).
explode: true
in: query
name: limit
required: false
schema:
default: 50
format: int32
maximum: 500
minimum: 1
type: integer
style: form
queryAppUserExpand:
description: |-
An optional query parameter to return the corresponding [User](/openapi/okta-management/management/tag/User/) object in the `_embedded` property.
Valid value: `user`
explode: true
in: query
name: expand
required: false
schema:
example: user
type: string
style: form
queryAppUserQ:
description: |
Specifies a filter for the list of Application Users returned based on their profile attributes.
The value of `q` is matched against the beginning of the following profile attributes: `userName`, `firstName`, `lastName`, and `email`.
This filter only supports the `startsWith` operation that matches the `q` string against the beginning of the attribute values.
> **Note:** For OIDC apps, user profiles don't contain the `firstName` or `lastName` attributes. Therefore, the query only matches against the `userName` or `email` attributes.
explode: true
in: query
name: q
required: false
schema:
example: sam
type: string
style: form
queryAppsExpand:
description: |-
An optional parameter used for link expansion to embed more resources in the response.
Only supports `expand=user/{userId}` and must be used with the `user.id eq "{userId}"` filter query for the same user.
Returns the assigned [Application User](/openapi/okta-management/management/tag/ApplicationUsers/) in the `_embedded` property.
explode: true
in: query
name: expand
required: false
schema:
example: user/0oa1gjh63g214q0Hq0g4
type: string
style: form
queryExpand:
description: "Valid value: `scope`. If specified, scope details are included\
\ in the `_embedded` attribute."
explode: true
in: query
name: expand
required: false
schema:
type: string
style: form
queryExpandBrand:
description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- themes
- domains
- emailDomain
type: string
type: array
style: form
queryExpandEmailDomain:
description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- brands
type: string
type: array
style: form
queryExpandEmailTemplate:
description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- settings
- customizationCount
type: string
type: array
style: form
queryExpandPageRoot:
description: Specifies additional metadata to be included in the response
explode: false
in: query
name: expand
required: false
schema:
items:
enum:
- default
- customized
- customizedUrl
- preview
- previewUrl
type: string
type: array
style: form
queryFilter:
description: Searches the records for matching value
explode: true
in: query
name: q
required: false
schema:
type: string
style: form
queryGroupAssignmentLimit:
description: |-
Specifies the number of objects to return per page.
If there are multiple pages of results, the Link header contains a `next` link that you need to use as an opaque value (follow it, don't parse it).
See [Pagination](/#pagination).
examples:
min:
summary: Minimum limit value
value: 20
hundred:
summary: Sample limit value
value: 100
max:
summary: Maximum limit value
value: 200
explode: true
in: query
name: limit
required: false
schema:
default: 20
format: int32
maximum: 200
minimum: 20
type: integer
style: form
queryGroupAssignmentWithGroupExpand:
description: "An optional query parameter to return the corresponding assigned\
\ [Group](/openapi/okta-management/management/tag/Group/) or \nthe group assignment\
\ metadata details in the `_embedded` property. "
examples:
group:
summary: Embedded assigned Group
value: group
metadata:
summary: Embedded group assignment metadata
value: metadata
explode: true
in: query
name: expand
required: false
schema:
example: group
type: string
style: form
queryGroupAssignmentWithMetadataExpand:
description: "An optional query parameter to return the corresponding assigned\
\ [Group](/openapi/okta-management/management/tag/Group/) or \nthe group assignment\
\ metadata details in the `_embedded` property. "
examples:
group:
summary: Embedded assigned Group
value: group
metadata:
summary: Embedded group assignment metadata
value: metadata
explode: true
in: query
name: expand
required: false
schema:
example: metadata
type: string
style: form
queryLanguage:
description: The language to use for the email. Defaults to the current user's
language if unspecified.
explode: true
in: query
name: language
required: false
schema:
$ref: '#/components/schemas/Language'
style: form
queryLimit:
description: A limit on the number of objects to return
explode: true
in: query
name: limit
required: false
schema:
default: 20
maximum: 200
minimum: 1
type: integer
style: form
queryLimitPerPoolType:
description: Maximum number of AgentPools being returned
explode: true
in: query
name: limitPerPoolType
required: false
schema:
default: 5
type: integer
style: form
queryPoolType:
description: Agent type to search for
explode: true
in: query
name: poolType
required: false
schema:
$ref: '#/components/schemas/AgentType'
style: form
queryScheduled:
description: Scope the list only to scheduled or ad-hoc updates. If the parameter
is not provided we will return the whole list of updates.
explode: true
in: query
name: scheduled
required: false
schema:
type: boolean
style: form
queryUserExpand:
description: "An optional parameter to include metadata in the `_embedded` attribute.\
\ Valid value: `blocks`"
explode: true
in: query
name: expand
required: false
schema:
example: blocks
type: string
style: form
simulateParameter:
description: Use `expand=EVALUATED` to include a list of evaluated but not matched
policies and policy rules. Use `expand=RULE` to include details about why
a rule condition wasn't matched.
explode: true
in: query
name: expand
required: false
schema:
example: EVALUATED
type: string
style: form
yubikeyTokenId:
description: ID of a Yubikey token
explode: false
in: path
name: tokenId
required: true
schema:
example: ykkxdtCA1fKVxyu6R0g3
type: string
style: simple
requestBodies:
AuthenticatorRequestBody:
content:
application/json:
examples:
Duo:
$ref: '#/components/examples/AuthenticatorRequestDuo'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
required: true
responses:
ErrorAppUserForbidden403:
content:
application/json:
examples:
AppUserProvEx:
$ref: '#/components/examples/ErrorAppUserForbiddenAction'
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
ErrorAppUserUpdateBadRequest400:
content:
application/json:
examples:
AppUserUpdateCredEx:
$ref: '#/components/examples/ErrorAppUserUpdateBadRequest'
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
AuthenticatorResponse:
content:
application/json:
examples:
Duo:
$ref: '#/components/examples/AuthenticatorResponseDuo'
Email:
$ref: '#/components/examples/AuthenticatorResponseEmail'
Password:
$ref: '#/components/examples/AuthenticatorResponsePassword'
Phone:
$ref: '#/components/examples/AuthenticatorResponsePhone'
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseWebAuthn'
SecurityQuestion:
$ref: '#/components/examples/AuthenticatorResponseSecurityQuestion'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
AuthenticatorResponseInactiveWebAuthn:
content:
application/json:
examples:
WebAuthn:
$ref: '#/components/examples/AuthenticatorResponseInactiveWebAuthn'
schema:
$ref: '#/components/schemas/AuthenticatorBase'
description: OK
ErrorApiValidationFailed400:
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/ErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
ErrorMissingRequiredParameter400:
content:
application/json:
examples:
MissingRequiredParameter:
$ref: '#/components/examples/ErrorMissingRequiredParameter'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
ErrorInvalidToken401:
content:
application/json:
examples:
InvalidTokenProvided:
$ref: '#/components/examples/ErrorInvalidTokenProvided'
schema:
$ref: '#/components/schemas/Error'
description: Unauthorized
ErrorAccessDenied403:
content:
application/json:
examples:
AccessDenied:
$ref: '#/components/examples/ErrorAccessDenied'
schema:
$ref: '#/components/schemas/Error'
description: Forbidden
ErrorResourceNotFound404:
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/ErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
ErrorTooManyRequests429:
content:
application/json:
examples:
TooManyRequests:
$ref: '#/components/examples/ErrorTooManyRequests'
schema:
$ref: '#/components/schemas/Error'
description: Too Many Requests
Error502NoConnectedAgents:
content:
application/json:
examples:
AgentTimeOut:
$ref: '#/components/examples/ErrorAgentTimeOut'
schema:
$ref: '#/components/schemas/Error'
description: There are no connected agents.
Error504AgentTimeOut:
content:
application/json:
examples:
AgentTimeOut:
$ref: '#/components/examples/ErrorNoConnectedAgents'
schema:
$ref: '#/components/schemas/Error'
description: Timed out waiting for agent.
DRStatusResponse:
content:
application/json:
schema:
description: List of domains and their disaster recovery status
items:
$ref: '#/components/schemas/DRStatusItem'
type: array
description: OK
headers:
Link:
description: A link to the next page of responses
explode: false
schema:
type: string
style: simple
ErrorResponse:
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
description: |
400 - When request validation fails
401 - When the user is not authenticated or the feature is not enabled
403 - When the user is not authorized
429 - When rate limits are exceeded
500 - When an internal server error is encountred
501 - When the operation is not supported
GetFactorResponse:
content:
application/json:
examples:
SMS:
$ref: '#/components/examples/FactorResponseSms'
Email:
$ref: '#/components/examples/FactorEmail'
schema:
$ref: '#/components/schemas/UserFactor'
description: Success
Error-FF-NotEnabled-Response-401:
content:
application/json:
examples:
Unauthorized:
value:
errorCode: E0000015
errorSummary: You do not have permission to access the feature you
are requesting
errorLink: E0000015
errorId: oaeStOuPPxDRUm3PJhf-tL7bQ
errorCauses: []
description: Unauthorized
ErrorInternalServer500:
content:
application/json:
examples:
InternalServerError:
$ref: '#/components/examples/ErrorInternalServer'
schema:
$ref: '#/components/schemas/Error'
description: Internal Server Error
NzErrorApiValidationFailed400:
content:
application/json:
examples:
APIValidationFailed:
$ref: '#/components/examples/NzErrorApiValidationFailed'
schema:
$ref: '#/components/schemas/Error'
description: Bad Request
NzErrorResourceNotFound404:
content:
application/json:
examples:
ResourceNotFound:
$ref: '#/components/examples/NzErrorResourceNotFound'
schema:
$ref: '#/components/schemas/Error'
description: Not Found
schemas:
AAGUIDGroupObject:
description: |
A `NEXT` Key is the next Key that the authorization server uses to sign tokens when Keys are rotated. The `NEXT` Key might not be listed if it hasn't been generated.
An `EXPIRED` Key is the previous Key that the authorization server used to sign tokens. The `EXPIRED` Key might not be listed if no Key has expired or the expired Key was deleted.
type: string
use:
description: "Acceptable use of the key. Valid value: `sig`"
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
AuthorizationServerPolicy:
allOf:
- properties:
id:
description: ID of the Policy
type: string
type:
description: Indicates that the Policy is an authorization server Policy
enum:
- OAUTH_AUTHORIZATION_POLICY
type: string
name:
description: Name of the Policy
type: string
conditions:
$ref: '#/components/schemas/AuthorizationServerPolicyConditions'
description:
description: Description of the Policy
type: string
priority:
description: Specifies the order in which this Policy is evaluated in
relation to the other Policies in a custom authorization server
type: integer
status:
description: Specifies whether requests have access to this Policy
enum:
- ACTIVE
- INACTIVE
type: string
system:
description: Specifies whether Okta created this Policy
type: boolean
created:
description: Timestamp when the Policy was created
format: date-time
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Policy was last updated
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/AuthorizationServerPolicy_allOf__links'
type: object
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
system: true
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
rules:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
name: name
description: description
id: id
type: OAUTH_AUTHORIZATION_POLICY
conditions:
clients:
include:
- include
- include
priority: 0
status: ACTIVE
AuthorizationServerPolicyConditions:
example:
clients:
include:
- include
- include
properties:
clients:
$ref: '#/components/schemas/ClientPolicyCondition'
type: object
AuthorizationServerPolicyPeopleCondition:
description: Identifies Users and Groups that are used together
example:
groups:
include:
- include
- include
users:
include:
- include
- include
properties:
groups:
$ref: '#/components/schemas/AuthorizationServerPolicyRuleGroupCondition'
users:
$ref: '#/components/schemas/AuthorizationServerPolicyRuleUserCondition'
type: object
AuthorizationServerPolicyRule:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
system: true
_links: ""
created: 2000-01-23T04:56:07.000+00:00
name: name
id: id
conditions:
grantTypes:
include:
- include
- include
scopes:
include:
- include
- include
people:
groups:
include:
- include
- include
users:
include:
- include
- include
priority: 5
type: RESOURCE_ACCESS
actions:
token:
refreshTokenWindowMinutes: 1
accessTokenLifetimeMinutes: 0
inlineHook:
id: id
refreshTokenLifetimeMinutes: 6
status: ACTIVE
properties:
actions:
$ref: '#/components/schemas/AuthorizationServerPolicyRuleActions'
conditions:
$ref: '#/components/schemas/AuthorizationServerPolicyRuleConditions'
created:
description: Timestamp when the rule was created
format: date-time
readOnly: true
type: string
id:
description: Identifier of the rule
readOnly: true
type: string
lastUpdated:
description: Timestamp when the rule was last modified
format: date-time
readOnly: true
type: string
name:
description: Name of the rule
type: string
priority:
description: Priority of the rule
type: integer
status:
description: Status of the rule
enum:
- ACTIVE
- INACTIVE
type: string
system:
description: Set to `true` for system rules. You can't delete system rules.
type: boolean
type:
description: Rule type
enum:
- RESOURCE_ACCESS
type: string
_links:
allOf:
- $ref: '#/components/schemas/LinksSelfAndLifecycle'
type: object
AuthorizationServerPolicyRuleActions:
allOf:
- $ref: '#/components/schemas/PolicyRuleActions'
- properties:
token:
$ref: '#/components/schemas/TokenAuthorizationServerPolicyRuleAction'
type: object
example:
token:
refreshTokenWindowMinutes: 1
accessTokenLifetimeMinutes: 0
inlineHook:
id: id
refreshTokenLifetimeMinutes: 6
AuthorizationServerPolicyRuleConditions:
example:
grantTypes:
include:
- include
- include
scopes:
include:
- include
- include
people:
groups:
include:
- include
- include
users:
include:
- include
- include
properties:
grantTypes:
$ref: '#/components/schemas/GrantTypePolicyRuleCondition'
people:
$ref: '#/components/schemas/AuthorizationServerPolicyPeopleCondition'
scopes:
$ref: '#/components/schemas/OAuth2ScopesMediationPolicyRuleCondition'
type: object
AuthorizationServerPolicyRuleGroupCondition:
description: Specifies a set of Groups whose Users are to be included
example:
include:
- include
- include
properties:
include:
description: Groups to be included
items:
type: string
type: array
type: object
AuthorizationServerPolicyRuleRequest:
allOf:
- $ref: '#/components/schemas/AuthorizationServerPolicyRule'
- required:
- conditions
- name
- type
type: object
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
system: true
_links: ""
created: 2000-01-23T04:56:07.000+00:00
name: name
id: id
conditions:
grantTypes:
include:
- include
- include
scopes:
include:
- include
- include
people:
groups:
include:
- include
- include
users:
include:
- include
- include
priority: 0
type: RESOURCE_ACCESS
actions:
token:
refreshTokenWindowMinutes: 1
accessTokenLifetimeMinutes: 0
inlineHook:
id: id
refreshTokenLifetimeMinutes: 6
status: ACTIVE
AuthorizationServerPolicyRuleUserCondition:
description: Specifies a set of Users to be included
example:
include:
- include
- include
properties:
include:
description: Users to be included
items:
type: string
type: array
type: object
AuthorizationServerResourceHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7"
type: string
title:
description: Link name
example: Example Authorization Server
type: string
type: object
AutoAssignAdminAppSetting:
description: The org setting that automatically assigns the Okta Admin Console
when an admin role is assigned
properties:
autoAssignAdminAppSetting:
description: Automatically assigns the Okta Admin Console to the user when
an admin role is assigned
type: boolean
type: object
AutoLoginApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/SchemeApplicationCredentials'
name:
description: A unique key is generated for the custom SWA app instance
when you use AUTO_LOGIN `signOnMode`.
readOnly: true
type: string
settings:
$ref: '#/components/schemas/AutoLoginApplicationSettings'
type: object
AutoLoginApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
signOn:
$ref: '#/components/schemas/AutoLoginApplicationSettingsSignOn'
type: object
AutoLoginApplicationSettingsSignOn:
properties:
loginUrl:
description: Primary URL of the sign-in page for this app
type: string
redirectUrl:
description: Secondary URL of the sign-in page for this app
type: string
required:
- loginUrl
type: object
AutoUpdateSchedule:
description: The schedule of auto-update configured by admin.
example:
cron: cron
duration: 6
lastUpdated: 2000-01-23T04:56:07.000+00:00
delay: 0
timezone: timezone
properties:
cron:
type: string
delay:
description: delay in days
type: integer
duration:
description: duration in minutes
type: integer
lastUpdated:
description: "last time when the updated finished (success or failed, exclude\
\ cancelled), null if job haven't finished once yet."
format: date-time
type: string
timezone:
type: string
type: object
AwsAccountId:
description: Your AWS account ID
example: "123456789012"
maxLength: 12
minLength: 12
type: string
AwsEventSourceName:
description: An alphanumeric name (no spaces) to identify this event source
in AWS EventBridge
example: your-event-source-name
maxLength: 75
minLength: 1
pattern: "^[a-zA-Z0-9.\\-_]$"
type: string
AwsRegion:
description: The destination AWS region where your event source is located
enum:
- ap-northeast-1
- ap-northeast-2
- ap-northeast-3
- ap-south-1
- ap-southeast-1
- ap-southeast-2
- ca-central-1
- eu-central-1
- eu-north-1
- eu-west-1
- eu-west-2
- eu-west-3
- sa-east-1
- us-east-1
- us-east-2
- us-west-1
- us-west-2
type: string
BaseContext:
description: "This object contains a number of sub-objects, each of which provide\
\ some type of contextual information."
properties:
request:
$ref: '#/components/schemas/InlineHookRequestObject'
session:
$ref: '#/components/schemas/BaseContext_session'
user:
$ref: '#/components/schemas/BaseContext_user'
type: object
BaseEmailDomain:
properties:
displayName:
type: string
userName:
type: string
required:
- displayName
- userName
type: object
BaseEmailServer:
properties:
alias:
description: Human-readable name for your SMTP server
example: CustomServer1
type: string
enabled:
description: "If `true`, routes all email traffic through your SMTP server"
type: boolean
host:
description: Hostname or IP address of your SMTP server
example: 192.168.160.1
type: string
port:
description: Port number of your SMTP server
example: 587
type: integer
username:
description: Username used to access your SMTP server
example: aUser
type: string
type: object
BaseToken:
properties:
claims:
description: "Claims included in the token. Consists of name-value pairs\
\ for each included claim. For descriptions of the claims that you can\
\ include, see the Okta [OpenID Connect and OAuth 2.0 API reference](/openapi/okta-oauth/guides/overview/#claims)."
type: object
lifetime:
$ref: '#/components/schemas/BaseToken_lifetime'
type: object
BasicApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
app:
$ref: '#/components/schemas/BasicApplicationSettingsApplication'
type: object
BasicApplicationSettingsApplication:
properties:
authURL:
description: The URL of the authenticating site for this app
type: string
url:
description: The URL of the sign-in page for this app
type: string
required:
- authURL
- url
type: object
BasicAuthApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/SchemeApplicationCredentials'
name:
description: '`template_basic_auth` is the key name for a Basic Authentication
scheme app instance'
enum:
- template_basic_auth
type: string
settings:
$ref: '#/components/schemas/BasicApplicationSettings'
required:
- name
- settings
type: object
x-okta-defined-as:
name: template_basic_auth
BeforeScheduledActionPolicyRuleCondition:
properties:
duration:
$ref: '#/components/schemas/Duration'
lifecycleAction:
$ref: '#/components/schemas/ScheduledUserLifecycleAction'
type: object
BehaviorRule:
discriminator:
mapping:
ANOMALOUS_LOCATION: '#/components/schemas/BehaviorRuleAnomalousLocation'
ANOMALOUS_IP: '#/components/schemas/BehaviorRuleAnomalousIP'
ANOMALOUS_DEVICE: '#/components/schemas/BehaviorRuleAnomalousDevice'
VELOCITY: '#/components/schemas/BehaviorRuleVelocity'
propertyName: type
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_link:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
name: name
id: id
type: ANOMALOUS_DEVICE
status: ACTIVE
properties:
created:
format: date-time
readOnly: true
type: string
id:
readOnly: true
type: string
lastUpdated:
format: date-time
readOnly: true
type: string
name:
maxLength: 128
type: string
status:
$ref: '#/components/schemas/LifecycleStatus'
type:
$ref: '#/components/schemas/BehaviorRuleType'
_link:
$ref: '#/components/schemas/LinksSelf'
required:
- name
- type
title: Behavior Detection Rule
type: object
BehaviorRuleAnomalousDevice:
allOf:
- $ref: '#/components/schemas/BehaviorRule'
- properties:
settings:
$ref: '#/components/schemas/BehaviorRuleSettingsAnomalousDevice'
type: object
BehaviorRuleAnomalousIP:
allOf:
- $ref: '#/components/schemas/BehaviorRule'
- properties:
settings:
$ref: '#/components/schemas/BehaviorRuleSettingsAnomalousIP'
type: object
BehaviorRuleAnomalousLocation:
allOf:
- $ref: '#/components/schemas/BehaviorRule'
- properties:
settings:
$ref: '#/components/schemas/BehaviorRuleSettingsAnomalousLocation'
type: object
BehaviorRuleSettings:
title: Behavior Detection Rule Settings
type: object
BehaviorRuleSettingsAnomalousDevice:
allOf:
- $ref: '#/components/schemas/BehaviorRuleSettingsHistoryBased'
BehaviorRuleSettingsAnomalousIP:
allOf:
- $ref: '#/components/schemas/BehaviorRuleSettingsHistoryBased'
- properties:
maxEventsUsedForEvaluation:
default: 50
maximum: 100
minimum: 0
type: integer
type: object
BehaviorRuleSettingsAnomalousLocation:
allOf:
- $ref: '#/components/schemas/BehaviorRuleSettingsHistoryBased'
- properties:
granularity:
$ref: '#/components/schemas/LocationGranularity'
radiusKilometers:
description: Required when `granularity` is `LAT_LONG`. Radius from the
provided coordinates in kilometers.
type: integer
required:
- granularity
type: object
BehaviorRuleSettingsHistoryBased:
allOf:
- $ref: '#/components/schemas/BehaviorRuleSettings'
- properties:
maxEventsUsedForEvaluation:
default: 20
maximum: 100
minimum: 1
type: integer
minEventsNeededForEvaluation:
default: 0
maximum: 10
minimum: 0
type: integer
title: Behavior Detection Rule Settings based on Event History
type: object
BehaviorRuleSettingsVelocity:
allOf:
- $ref: '#/components/schemas/BehaviorRuleSettings'
- properties:
velocityKph:
default: 805
minimum: 1
type: integer
required:
- velocityKph
title: Behavior Detection Rule Settings based on device velocity in kilometers
per hour.
type: object
BehaviorRuleType:
enum:
- ANOMALOUS_DEVICE
- ANOMALOUS_IP
- ANOMALOUS_LOCATION
- VELOCITY
type: string
BehaviorRuleVelocity:
allOf:
- $ref: '#/components/schemas/BehaviorRule'
- properties:
settings:
$ref: '#/components/schemas/BehaviorRuleSettingsVelocity'
type: object
BindingMethod:
description: The method used to bind the out-of-band channel with the primary
channel.
enum:
- none
- prompt
- transfer
type: string
BookmarkApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/ApplicationCredentials'
name:
description: '`bookmark` is the key name for a Bookmark app'
enum:
- bookmark
type: string
settings:
$ref: '#/components/schemas/BookmarkApplicationSettings'
required:
- name
- settings
type: object
x-okta-defined-as:
name: bookmark
BookmarkApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
app:
$ref: '#/components/schemas/BookmarkApplicationSettingsApplication'
type: object
BookmarkApplicationSettingsApplication:
properties:
requestIntegration:
default: false
description: Would you like Okta to add an integration for this app?
type: boolean
url:
description: The URL of the launch page for this app
type: string
required:
- url
type: object
BouncesRemoveListError:
example:
reason: reason
emailAddress: emailAddress
properties:
emailAddress:
description: An email address with a validation error
type: string
reason:
description: Validation error reason
type: string
type: object
BouncesRemoveListObj:
example:
emailAddresses:
- emailAddresses
- emailAddresses
properties:
emailAddresses:
description: A list of email addresses to remove from the email-service
bounce list
items:
description: Email address
type: string
type: array
type: object
BouncesRemoveListResult:
example:
errors:
- reason: reason
emailAddress: emailAddress
- reason: reason
emailAddress: emailAddress
properties:
errors:
description: A list of emails that wasn't added to the email-bounced remove
list and the error reason
items:
$ref: '#/components/schemas/BouncesRemoveListError'
type: array
type: object
Brand:
example:
agreeToCustomPrivacyPolicy: true
defaultApp:
appInstanceId: appInstanceId
appLinkName: appLinkName
classicApplicationUri: classicApplicationUri
isDefault: true
removePoweredByOkta: false
name: name
id: id
emailDomainId: emailDomainId
locale: locale
customPrivacyPolicyUrl: customPrivacyPolicyUrl
properties:
agreeToCustomPrivacyPolicy:
description: Consent for updating the custom privacy URL. Not required when
resetting the URL.
type: boolean
customPrivacyPolicyUrl:
description: Custom privacy policy URL
type: string
defaultApp:
$ref: '#/components/schemas/DefaultApp'
emailDomainId:
description: The ID of the email domain
type: string
id:
description: The Brand ID
readOnly: true
type: string
isDefault:
description: "If `true`, the Brand is used for the Okta subdomain"
readOnly: true
type: boolean
locale:
description: "The language specified as an [IETF BCP 47 language tag](https://datatracker.ietf.org/doc/html/rfc5646)"
type: string
name:
description: The name of the Brand
type: string
removePoweredByOkta:
default: false
description: "Removes \"Powered by Okta\" from the sign-in page in redirect\
\ authentication deployments, and \"© [current year] Okta, Inc.\" from\
\ the Okta End-User Dashboard"
type: boolean
type: object
BrandDomains:
items:
$ref: '#/components/schemas/DomainResponse'
title: BrandDomains
type: array
BrandRequest:
example:
agreeToCustomPrivacyPolicy: true
defaultApp:
appInstanceId: appInstanceId
appLinkName: appLinkName
classicApplicationUri: classicApplicationUri
removePoweredByOkta: false
name: name
emailDomainId: emailDomainId
locale: locale
customPrivacyPolicyUrl: customPrivacyPolicyUrl
properties:
agreeToCustomPrivacyPolicy:
description: Consent for updating the custom privacy URL. Not required when
resetting the URL.
type: boolean
customPrivacyPolicyUrl:
description: Custom privacy policy URL
type: string
defaultApp:
$ref: '#/components/schemas/DefaultApp'
emailDomainId:
description: The ID of the email domain
type: string
locale:
description: "The language specified as an [IETF BCP 47 language tag](https://datatracker.ietf.org/doc/html/rfc5646)"
type: string
name:
description: The name of the Brand
type: string
removePoweredByOkta:
default: false
description: "Removes \"Powered by Okta\" from the sign-in page in redirect\
\ authentication deployments, and \"© [current year] Okta, Inc.\" from\
\ the Okta End-User Dashboard"
type: boolean
required:
- name
type: object
BrandWithEmbedded:
allOf:
- $ref: '#/components/schemas/Brand'
example:
_embedded: "{}"
_links: ""
properties:
_embedded:
properties:
themes:
items:
$ref: '#/components/schemas/ThemeResponse'
type: array
domains:
items:
$ref: '#/components/schemas/DomainResponse'
type: array
emailDomain:
$ref: '#/components/schemas/EmailDomainResponse'
readOnly: true
type: object
_links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
themes:
$ref: '#/components/schemas/HrefObject'
type: object
BrowserPluginApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/SchemeApplicationCredentials'
name:
description: The key name for the app definition
enum:
- template_swa
- template_swa3field
type: string
x-enumDescriptions:
template_swa: The key name for a SWA app instance that requires a browser
plugin
template_swa3field: The key name for a SWA app instance that requires
a browser plugin and supports three CSS selectors
settings:
$ref: '#/components/schemas/SwaApplicationSettings'
required:
- name
- settings
type: object
BulkDeleteRequestBody:
example:
entityType: USERS
profiles:
- externalId: externalId
- externalId: externalId
properties:
entityType:
enum:
- USERS
type: string
profiles:
items:
$ref: '#/components/schemas/IdentitySourceUserProfileForDelete'
type: array
type: object
BulkUpsertRequestBody:
example:
entityType: USERS
profiles:
- profile:
firstName: firstName
lastName: lastName
mobilePhone: mobilePhone
secondEmail: secondEmail
userName: userName
email: email
homeAddress: homeAddress
externalId: externalId
- profile:
firstName: firstName
lastName: lastName
mobilePhone: mobilePhone
secondEmail: secondEmail
userName: userName
email: email
homeAddress: homeAddress
externalId: externalId
properties:
entityType:
enum:
- USERS
type: string
profiles:
items:
$ref: '#/components/schemas/BulkUpsertRequestBody_profiles_inner'
type: array
type: object
BundleEntitlement:
properties:
description:
type: string
id:
type: string
name:
type: string
role:
type: string
_links:
$ref: '#/components/schemas/BundleEntitlement__links'
type: object
BundleEntitlementsResponse:
properties:
entitlements:
items:
$ref: '#/components/schemas/BundleEntitlement'
type: array
_links:
$ref: '#/components/schemas/BundleEntitlementsResponse__links'
type: object
ByDateTimeExpiry:
allOf:
- $ref: '#/components/schemas/DateTime'
ByDurationExpiry:
allOf:
- $ref: '#/components/schemas/TimeDuration'
description: |-
A time duration specified as an [ISO-8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations).
Must be between 1 and 180 days inclusive.
CAPTCHAInstance:
description: ""
example:
siteKey: siteKey
secretKey: secretKey
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: HCAPTCHA
properties:
id:
description: The unique key for the CAPTCHA instance
readOnly: true
type: string
name:
description: The name of the CAPTCHA instance
type: string
secretKey:
description: The secret key issued from the CAPTCHA provider to perform
server-side validation for a CAPTCHA token
type: string
writeOnly: true
siteKey:
description: The site key issued from the CAPTCHA provider to render a CAPTCHA
on a page
type: string
type:
$ref: '#/components/schemas/CAPTCHAType'
_links:
$ref: '#/components/schemas/LinksSelf'
title: CAPTCHAInstance
type: object
CAPTCHAType:
description: The type of CAPTCHA provider
enum:
- HCAPTCHA
- RECAPTCHA_V2
type: string
CSRLinks:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of a CSR object using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources\
\ and lifecycle operations."
example:
publish:
hints:
allow:
- POST
- POST
href: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish"
self:
hints:
allow:
- GET
- GET
href: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50"
properties:
publish:
$ref: '#/components/schemas/HrefCsrPublishLink'
self:
$ref: '#/components/schemas/HrefCsrSelfLink'
readOnly: true
CaepDeviceComplianceChangeEvent:
description: The subject's device compliance was revoked
properties:
current_status:
description: Current device compliance status
enum:
- compliant
- not-compliant
example: non-compliant
type: string
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
initiating_entity:
description: The entity that initiated the event
enum:
- admin
- user
- policy
- system
type: string
previous_status:
description: Previous device compliance status
enum:
- compliant
- not-compliant
type: string
reason_admin:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_admin'
reason_user:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_user'
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- current_status
- event_timestamp
- previous_status
- subject
type: object
CaepSecurityEvent:
properties:
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
initiating_entity:
description: The entity that initiated the event
enum:
- admin
- user
- policy
- system
type: string
reason_admin:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_admin'
reason_user:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_user'
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- event_timestamp
- subject
type: object
CaepSessionRevokedEvent:
description: The session of the subject was revoked
properties:
current_ip:
description: Current IP of the session
example: 123.4.5.6
type: string
current_user_agent:
description: Current User Agent of the session
example: CurrentUserAgent
type: string
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
initiating_entity:
description: The entity that initiated the event
enum:
- admin
- user
- policy
- system
type: string
last_known_ip:
description: Last known IP of the session
example: 123.4.5.6
type: string
last_known_user_agent:
description: Last known User Agent of the session
example: LastUserAgent
type: string
reason_admin:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_admin'
reason_user:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_user'
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- event_timestamp
- subject
type: object
CapabilitiesCreateObject:
description: |
Determines whether Okta assigns a new app account to each user managed by Okta.
Okta doesn't create a new account if it detects that the username specified in Okta already exists in the app.
The user's Okta username is assigned by default.
properties:
lifecycleCreate:
$ref: '#/components/schemas/LifecycleCreateSettingObject'
type: object
CapabilitiesImportRulesObject:
description: Defines user import rules
properties:
userCreateAndMatch:
$ref: '#/components/schemas/CapabilitiesImportRulesUserCreateAndMatchObject'
type: object
CapabilitiesImportRulesUserCreateAndMatchObject:
description: Rules for matching and creating users
properties:
allowPartialMatch:
description: "Allows user import upon partial matching. Partial matching\
\ occurs when the first and last names of an imported user match those\
\ of an existing Okta user, even if the username or email attributes don't\
\ match."
type: boolean
autoActivateNewUsers:
description: "If set to `true`, imported new users are automatically activated."
type: boolean
autoConfirmExactMatch:
description: "If set to `true`, exact-matched users are automatically confirmed\
\ on activation. If set to `false`, exact-matched users need to be confirmed\
\ manually."
type: boolean
autoConfirmNewUsers:
description: "If set to `true`, imported new users are automatically confirmed\
\ on activation. This doesn't apply to imported users that already exist\
\ in Okta."
type: boolean
autoConfirmPartialMatch:
description: "If set to `true`, partially matched users are automatically\
\ confirmed on activation. If set to `false`, partially matched users\
\ need to be confirmed manually."
type: boolean
exactMatchCriteria:
description: Determines the attribute to match users
enum:
- EMAIL
- USERNAME
type: string
type: object
CapabilitiesImportSettingsObject:
description: Defines import settings
properties:
schedule:
$ref: '#/components/schemas/ImportScheduleObject'
username:
$ref: '#/components/schemas/ImportUsernameObject'
type: object
CapabilitiesInboundProvisioningObject:
description: Defines the configuration for the INBOUND_PROVISIONING feature
properties:
importRules:
$ref: '#/components/schemas/CapabilitiesImportRulesObject'
importSettings:
$ref: '#/components/schemas/CapabilitiesImportSettingsObject'
required:
- importRules
- importSettings
title: INBOUND_PROVISIONING
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
CapabilitiesObject:
description: Defines the configurations for the USER_PROVISIONING feature
properties:
create:
$ref: '#/components/schemas/CapabilitiesCreateObject'
update:
$ref: '#/components/schemas/CapabilitiesUpdateObject'
title: USER_PROVISIONING
type: object
CapabilitiesUpdateObject:
description: Determines whether updates to a user's profile are pushed to the
app
properties:
lifecycleDeactivate:
$ref: '#/components/schemas/LifecycleDeactivateSettingObject'
password:
$ref: '#/components/schemas/PasswordSettingObject'
profile:
$ref: '#/components/schemas/ProfileSettingObject'
type: object
CatalogApplication:
example:
features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
properties:
category:
type: string
description:
type: string
displayName:
type: string
features:
items:
type: string
type: array
id:
readOnly: true
type: string
lastUpdated:
format: date-time
readOnly: true
type: string
name:
type: string
signOnModes:
items:
type: string
type: array
status:
$ref: '#/components/schemas/CatalogApplicationStatus'
verificationStatus:
type: string
website:
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
CatalogApplicationStatus:
enum:
- ACTIVE
- INACTIVE
type: string
ChallengeType:
enum:
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
type: string
ChangeEnum:
default: KEEP_EXISTING
description: Determines whether a change in a user's password also updates the
user's password in the app
enum:
- CHANGE
- KEEP_EXISTING
example: CHANGE
type: string
ChangePasswordRequest:
example:
oldPassword:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
newPassword:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
revokeSessions: false
properties:
newPassword:
$ref: '#/components/schemas/PasswordCredential'
oldPassword:
$ref: '#/components/schemas/PasswordCredential'
revokeSessions:
default: false
description: "When set to `true`, revokes all User sessions, except for\
\ the current session"
type: boolean
type: object
Channel:
description: The out-of-band channel for use with authentication. Required for
all `/oob-authenticate` requests and any `/challenge` request with an out-of-band
authenticator.
enum:
- push
- sms
- voice
type: string
ChannelBinding:
properties:
required:
$ref: '#/components/schemas/RequiredEnum'
style:
enum:
- NUMBER_CHALLENGE
type: string
type: object
ChildOrg:
example:
settings:
key: ""
website: https://www.okta.com
_links:
key: ""
created: 2022-08-25T00:05:00Z
admin:
credentials:
password:
value: pa$$word
recovery_question:
answer: se7en
question: what is your favourite movie?
profile:
firstName: firstName
lastName: lastName
login: login
email: email
edition: SKU
token: token
lastUpdated: 2022-08-25T00:05:00Z
name: My Child Org 1
subdomain: my-child-org-1
id: 00o1n8sbwArJ7OQRw406
tokenType: SSWS
status: ACTIVE
properties:
admin:
$ref: '#/components/schemas/OrgCreationAdmin'
created:
description: Timestamp when the Org was created
example: 2022-08-25T00:05:00Z
format: date-time
readOnly: true
type: string
edition:
description: Edition for the Org. `SKU` is the only supported value.
enum:
- SKU
example: SKU
type: string
id:
description: Org ID
example: 00o1n8sbwArJ7OQRw406
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Org was last updated
example: 2022-08-25T00:05:00Z
format: date-time
readOnly: true
type: string
name:
description: |-
Unique name of the Org.
This name appears in the HTML `` tag of the new Org sign-in page.
Only less than 4-width UTF-8 encoded characters are allowed.
example: My Child Org 1
format: utf-8
maximum: 100
minimum: 1
type: string
settings:
additionalProperties: true
description: Settings associated with the created Org
readOnly: true
type: object
status:
description: Status of the Org. `ACTIVE` is returned after the Org is created.
enum:
- ACTIVE
readOnly: true
type: string
subdomain:
description: Subdomain of the Org. Must be unique and include no spaces.
example: my-child-org-1
maximum: 57
minimum: 1
type: string
token:
description: |-
API token associated with the child Org super admin account.
Use this API token to provision resources (such as policies, apps, and groups) on the newly created child Org.
This token is revoked if the super admin account is deactivated.
> **Note:** If this API token expires, sign in to the Admin Console as the super admin user and create a new API token. See [Create an API token](https://developer.okta.com/docs/guides/create-an-api-token/).
readOnly: true
type: string
tokenType:
description: "Type of returned `token`. See [Okta API tokens](https://developer.okta.com/docs/guides/create-an-api-token/main/#okta-api-tokens)."
enum:
- SSWS
example: SSWS
readOnly: true
type: string
website:
description: Default website for the Org
example: https://www.okta.com
type: string
_links:
additionalProperties: true
description: "Specifies available link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
readOnly: true
type: object
required:
- admin
- edition
- name
- subdomain
type: object
ChromeBrowserVersion:
description: Current version of the Chrome Browser
properties:
minimum:
type: string
type: object
Claim:
type: string
Client:
properties:
application_type:
$ref: '#/components/schemas/ApplicationType'
client_id:
description: "Unique key for the client application. The `client_id` is\
\ immutable. When you create a client Application, you can't specify the\
\ `client_id` because Okta uses the application ID for the `client_id`."
readOnly: true
type: string
client_id_issued_at:
description: Time at which the `client_id` was issued (measured in unix
seconds)
readOnly: true
type: integer
client_name:
description: Human-readable string name of the client application
type: string
client_secret:
description: "OAuth 2.0 client secret string (used for confidential clients).\
\ The `client_secret` is shown only on the response of the creation or\
\ update of a client Application (and only if the `token_endpoint_auth_method`\
\ is one that requires a client secret). You can't specify the `client_secret`.\
\ If the `token_endpoint_auth_method` requires one, Okta generates a random\
\ `client_secret` for the client Application."
nullable: true
readOnly: true
type: string
client_secret_expires_at:
description: Time at which the `client_secret` expires or 0 if it doesn't
expire (measured in unix seconds)
minimum: 0
nullable: true
readOnly: true
type: integer
frontchannel_logout_session_required:
description: Include user session details
type: boolean
frontchannel_logout_uri:
description: URL where Okta sends the logout request
nullable: true
type: string
grant_types:
description: "Array of OAuth 2.0 grant type strings. Default value: `[authorization_code]`"
items:
$ref: '#/components/schemas/GrantType'
type: array
initiate_login_uri:
description: URL that a third party can use to initiate a login by the client
type: string
jwks_uri:
description: "URL string that references a [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5)\
\ for validating JWTs presented to Okta"
type: string
logo_uri:
description: URL string that references a logo for the client consent dialog
(not the sign-in dialog)
nullable: true
type: string
policy_uri:
description: URL string of a web page providing the client's policy document
nullable: true
type: string
post_logout_redirect_uris:
description: Array of redirection URI strings for use for relying party
initiated logouts
items:
type: string
type: array
redirect_uris:
description: "Array of redirection URI strings for use in redirect-based\
\ flows. All redirect URIs must be absolute URIs and must not include\
\ a fragment component. At least one redirect URI and response type is\
\ required for all client types, with the following exceptions: If the\
\ client uses the Resource Owner Password flow (if `grant_type` contains\
\ the value password) or the Client Credentials flow (if `grant_type`\
\ contains the value `client_credentials`), then no redirect URI or response\
\ type is necessary. In these cases, you can pass either null or an empty\
\ array for these attributes."
items:
type: string
type: array
request_object_signing_alg:
description: "The type of [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5)\
\ algorithm that must be used for signing request objects"
items:
$ref: '#/components/schemas/SigningAlgorithm'
type: array
response_types:
description: "Array of OAuth 2.0 response type strings. Default value: `[code]`"
items:
$ref: '#/components/schemas/ResponseType'
type: array
token_endpoint_auth_method:
$ref: '#/components/schemas/EndpointAuthMethod'
tos_uri:
description: URL string of a web page providing the client's terms of service
document
nullable: true
type: string
type: object
ClientPolicyCondition:
description: Specifies which clients are included in the Policy
example:
include:
- include
- include
properties:
include:
description: Which clients are included in the Policy
items:
type: string
type: array
type: object
ClientPrivilegesSetting:
description: The org setting that assigns the super admin role by default to
a public client app
example:
clientPrivilegesSetting: true
properties:
clientPrivilegesSetting:
description: "If true, assigns the super admin role by default to new public\
\ client apps"
example: true
type: boolean
type: object
CodeChallengeMethod:
enum:
- S256
type: string
Compliance:
properties:
fips:
$ref: '#/components/schemas/FipsEnum'
type: object
Conditions:
example:
expression:
value: value
profileSourceId: profileSourceId
properties:
expression:
$ref: '#/components/schemas/Expression'
profileSourceId:
type: string
type: object
ContentSecurityPolicySetting:
example:
mode: enforced
reportUri: reportUri
srcList:
- srcList
- srcList
properties:
mode:
enum:
- enforced
- report_only
type: string
reportUri:
type: string
srcList:
items:
type: string
type: array
type: object
ContextPolicyRuleCondition:
allOf:
- $ref: '#/components/schemas/DevicePolicyRuleCondition'
- properties:
expression:
type: string
type: object
CreateBrandRequest:
example:
name: name
properties:
name:
description: The name of the Brand
type: string
required:
- name
title: CreateBrandRequest
type: object
CreateGroupRuleRequest:
example:
name: name
conditions:
expression:
type: type
value: user.role==\"Engineer\"
people:
groups:
exclude:
- exclude
- exclude
users:
exclude:
- exclude
- exclude
type: group_rule
actions:
assignUserToGroups:
groupIds:
- groupIds
- groupIds
properties:
actions:
$ref: '#/components/schemas/GroupRuleAction'
conditions:
$ref: '#/components/schemas/GroupRuleConditions'
name:
description: Name of the Group rule
maxLength: 50
minLength: 1
type: string
type:
enum:
- group_rule
type: string
type: object
CreateIamRoleRequest:
example:
permissions:
- okta.apps.assignment.manage
- okta.apps.assignment.manage
description: description
label: label
properties:
description:
description: Description of the role
type: string
label:
description: Unique label for the role
type: string
permissions:
description: "Array of permissions that the Role grants. See [Permissions](/openapi/okta-management/guides/roles/#permissions)."
items:
$ref: '#/components/schemas/RolePermissionType'
type: array
required:
- description
- label
- permissions
type: object
CreateRealmAssignmentRequest:
example:
name: name
conditions:
expression:
value: value
profileSourceId: profileSourceId
priority: 0
actions:
assignUserToRealm:
realmId: realmId
properties:
actions:
$ref: '#/components/schemas/Actions'
conditions:
$ref: '#/components/schemas/Conditions'
name:
type: string
priority:
type: integer
type: object
CreateRealmRequest:
example:
profile:
realmType: PARTNER
name: name
properties:
profile:
$ref: '#/components/schemas/RealmProfile'
type: object
CreateResourceSetRequest:
example:
description: description
resources:
- resources
- resources
label: label
properties:
description:
description: Description of the Resource Set
type: string
label:
description: Unique name for the Resource Set
type: string
resources:
description: "The endpoint (URL) that references all resource objects included\
\ in the Resource Set. Resources are identified by either an Okta Resource\
\ Name (ORN) or by a REST URL format. See [Okta Resource Name](/openapi/okta-management/guides/roles/#okta-resource-name-orn)."
items:
type: string
maximum: 1000
type: array
required:
- description
- label
- resources
type: object
CreateSessionRequest:
example:
sessionToken: sessionToken
properties:
sessionToken:
description: The session token obtained during authentication
type: string
type: object
CreateUISchema:
description: The request body properties for the new UI Schema
example:
uiSchema:
elements:
scope: scope
options:
format: text
label: label
type: type
label: Sign in
type: type
buttonLabel: Submit
properties:
uiSchema:
$ref: '#/components/schemas/UISchemaObject'
type: object
CreateUpdateIamRolePermissionRequest:
example:
conditions:
include:
key: "{}"
exclude:
key: "{}"
properties:
conditions:
$ref: '#/components/schemas/PermissionConditions'
type: object
CreateUserRequest:
example:
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
groupIds:
- groupIds
- groupIds
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
id: id
properties:
credentials:
$ref: '#/components/schemas/UserCredentials'
groupIds:
items:
type: string
type: array
profile:
$ref: '#/components/schemas/UserProfile'
realmId:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>The
ID of the Realm in which the User is residing
example: guo1bfiNtSnZYILxO0g4
type: string
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
type:
$ref: '#/components/schemas/CreateUserRequest_type'
required:
- profile
type: object
CreateUserTypeRequest:
example:
displayName: displayName
name: name
description: description
properties:
name:
description: The updated human-readable name for the User Type
type: string
displayName:
description: The updated human-readable display name for the User Type
type: string
description:
description: The updated human-readable description of the User Type
type: string
type: object
Created:
description: Timestamp when the object was created
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
CredentialSyncInfo:
properties:
errorCode:
description: The error code for the type of error
readOnly: true
type: string
errorReason:
description: A short description of the error
readOnly: true
type: string
secretVersionId:
description: The version ID of the password secret from the OPA vault.
example: 9f8400-e29b-41d4-a716-926655440034
maxLength: 36
minLength: 1
type: string
syncState:
$ref: '#/components/schemas/CredentialSyncState'
syncTime:
description: Timestamp when the credential was changed
example: 2024-06-10T11:30:01Z
format: date-time
readOnly: true
type: string
type: object
CredentialSyncState:
description: Current credential sync status of the privileged resource
enum:
- NOT_SYNCED
- SYNCED
- SYNCING
- SYNC_FAILED
readOnly: true
type: string
x-enumDescriptions:
NOT_SYNCED: Credentials are not yet synced
SYNCING: Credentials are currently being synced
SYNCED: Credentials are successfully synced
SYNC_FAILED: Credential sync failed
Csr:
example:
kty: RSA
csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
_links:
publish:
hints:
allow:
- POST
- POST
href: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish"
self:
hints:
allow:
- GET
- GET
href: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50"
created: 2017-03-28T01:11:10Z
id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50
properties:
created:
description: Timestamp when the object was created
example: 2017-03-28T01:11:10Z
format: date-time
readOnly: true
type: string
csr:
example: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
readOnly: true
type: string
id:
example: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50
readOnly: true
type: string
kty:
example: RSA
readOnly: true
type: string
_links:
$ref: '#/components/schemas/CSRLinks'
type: object
CsrMetadata:
example:
subject:
commonName: SP Issuer
localityName: San Francisco
organizationName: "Okta, Inc."
organizationalUnitName: Dev
countryName: US
stateOrProvinceName: California
subjectAltNames:
dnsNames:
- dev.okta.com
- dev.okta.com
properties:
subject:
$ref: '#/components/schemas/CsrMetadataSubject'
subjectAltNames:
$ref: '#/components/schemas/CsrMetadataSubjectAltNames'
type: object
CsrMetadataSubject:
example:
commonName: SP Issuer
localityName: San Francisco
organizationName: "Okta, Inc."
organizationalUnitName: Dev
countryName: US
stateOrProvinceName: California
properties:
commonName:
description: Common name of the subject
example: SP Issuer
type: string
countryName:
description: Country name or code
example: US
type: string
localityName:
description: Locality (city) name
example: San Francisco
type: string
organizationalUnitName:
description: "Name of the smaller organization, for example, the department\
\ or the division"
example: Dev
type: string
organizationName:
description: Large organization name
example: "Okta, Inc."
type: string
stateOrProvinceName:
description: State or province name
example: California
type: string
type: object
CsrMetadataSubjectAltNames:
example:
dnsNames:
- dev.okta.com
- dev.okta.com
properties:
dnsNames:
description: DNS names of the subject
items:
example: dev.okta.com
type: string
type: array
type: object
CsrPublishHrefHints:
description: Describes allowed HTTP verbs for the `href`
example:
allow:
- POST
- POST
properties:
allow:
items:
enum:
- POST
type: string
type: array
type: object
CsrSelfHrefHints:
description: Describes allowed HTTP verbs for the `href`
example:
allow:
- GET
- GET
properties:
allow:
items:
enum:
- GET
- DELETE
type: string
type: array
type: object
CustomAppUserVerificationEnum:
description: User verification setting
enum:
- PREFERRED
- REQUIRED
type: string
CustomRole:
properties:
assignmentType:
$ref: '#/components/schemas/RoleAssignmentType'
created:
description: Timestamp when the object was created
format: date-time
readOnly: true
type: string
id:
description: Binding Object ID
readOnly: true
type: string
label:
description: Label for the custom role assignment
readOnly: true
type: string
lastUpdated:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
resource-set:
description: Resource Set ID
readOnly: true
type: string
role:
description: Custom Role ID
readOnly: true
type: string
status:
allOf:
- $ref: '#/components/schemas/LifecycleStatus'
- description: Status of the Custom Role Assignment
type:
description: CUSTOM for a custom role
enum:
- CUSTOM
type: string
_links:
$ref: '#/components/schemas/LinksCustomRoleResponse'
title: Custom Role Assignment
type: object
CustomRoleAssignmentSchema:
properties:
resource-set:
description: Resource Set ID
type: string
role:
description: Custom Role ID
type: string
type:
description: The type of role. Specify `CUSTOM` for a custom role.
enum:
- CUSTOM
type: string
title: Custom Role
type: object
CustomizablePage:
example:
pageContent: pageContent
properties:
pageContent:
description: The HTML for the page
type: string
type: object
DNSRecord:
description: DNS TXT and CNAME records to be registered for the Domain
example:
fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
properties:
expiration:
description: DNS TXT record expiration
type: string
fqdn:
description: DNS record name
example: _oktaverification.login.example.com
type: string
recordType:
$ref: '#/components/schemas/DNSRecordType'
values:
description: DNS record value
example:
- 79496f234c814638b1cc44f51a782781
items:
type: string
type: array
type: object
DNSRecordType:
enum:
- CNAME
- TXT
example: TXT
type: string
DRStatusItem:
description: Provides the status whether a domain has been failed over or not
properties:
domain:
description: domain
type: string
isFailedOver:
description: Indicates if the domain has been failed over
nullable: false
type: boolean
type: object
DTCChromeOS:
description: Google Chrome Device Trust Connector provider
properties:
allowScreenLock:
description: Indicates whether the AllowScreenLock enterprise policy is
enabled
type: boolean
browserVersion:
$ref: '#/components/schemas/ChromeBrowserVersion'
builtInDnsClientEnabled:
description: Indicates if a software stack is used to communicate with the
DNS server
type: boolean
chromeRemoteDesktopAppBlocked:
description: Indicates whether access to the Chrome Remote Desktop application
is blocked through a policy
type: boolean
deviceEnrollmentDomain:
description: Enrollment domain of the customer that is currently managing
the device
type: string
diskEncrypted:
description: Indicates whether the main disk is encrypted
type: boolean
keyTrustLevel:
$ref: '#/components/schemas/KeyTrustLevelOSMode'
managedDevice:
description: Indicates whether the device is enrolled in ChromeOS device
management
type: boolean
osFirewall:
description: Indicates whether a firewall is enabled at the OS-level on
the device
type: boolean
osVersion:
$ref: '#/components/schemas/OSVersionFourComponents'
passwordProtectionWarningTrigger:
$ref: '#/components/schemas/PasswordProtectionWarningTrigger'
realtimeUrlCheckMode:
description: Indicates whether enterprise-grade (custom) unsafe URL scanning
is enabled
type: boolean
safeBrowsingProtectionLevel:
$ref: '#/components/schemas/SafeBrowsingProtectionLevel'
screenLockSecured:
description: Indicates whether the device is password-protected
type: boolean
siteIsolationEnabled:
description: Indicates whether the Site Isolation (also known as **Site
Per Process**) setting is enabled
type: boolean
type: object
DTCMacOS:
description: Google Chrome Device Trust Connector provider
properties:
browserVersion:
$ref: '#/components/schemas/ChromeBrowserVersion'
builtInDnsClientEnabled:
description: Indicates if a software stack is used to communicate with the
DNS server
type: boolean
chromeRemoteDesktopAppBlocked:
description: Indicates whether access to the Chrome Remote Desktop application
is blocked through a policy
type: boolean
deviceEnrollmentDomain:
description: Enrollment domain of the customer that is currently managing
the device
type: string
diskEncrypted:
description: Indicates whether the main disk is encrypted
type: boolean
keyTrustLevel:
$ref: '#/components/schemas/KeyTrustLevelBrowserKey'
osFirewall:
description: Indicates whether a firewall is enabled at the OS-level on
the device
type: boolean
osVersion:
$ref: '#/components/schemas/OSVersionThreeComponents'
passwordProtectionWarningTrigger:
$ref: '#/components/schemas/PasswordProtectionWarningTrigger'
realtimeUrlCheckMode:
description: Indicates whether enterprise-grade (custom) unsafe URL scanning
is enabled
type: boolean
safeBrowsingProtectionLevel:
$ref: '#/components/schemas/SafeBrowsingProtectionLevel'
screenLockSecured:
description: Indicates whether the device is password-protected
type: boolean
siteIsolationEnabled:
description: Indicates whether the Site Isolation (also known as **Site
Per Process**) setting is enabled
type: boolean
type: object
DTCWindows:
description: Google Chrome Device Trust Connector provider
properties:
browserVersion:
$ref: '#/components/schemas/ChromeBrowserVersion'
builtInDnsClientEnabled:
description: Indicates if a software stack is used to communicate with the
DNS server
type: boolean
chromeRemoteDesktopAppBlocked:
description: Indicates whether access to the Chrome Remote Desktop application
is blocked through a policy
type: boolean
crowdStrikeAgentId:
description: Agent ID of an installed CrowdStrike agent
type: string
crowdStrikeCustomerId:
description: Customer ID of an installed CrowdStrike agent
type: string
deviceEnrollmentDomain:
description: Enrollment domain of the customer that is currently managing
the device
type: string
diskEncrypted:
description: Indicates whether the main disk is encrypted
type: boolean
keyTrustLevel:
$ref: '#/components/schemas/KeyTrustLevelBrowserKey'
osFirewall:
description: Indicates whether a firewall is enabled at the OS-level on
the device
type: boolean
osVersion:
$ref: '#/components/schemas/OSVersionFourComponents'
passwordProtectionWarningTrigger:
$ref: '#/components/schemas/PasswordProtectionWarningTrigger'
realtimeUrlCheckMode:
description: Indicates whether enterprise-grade (custom) unsafe URL scanning
is enabled
type: boolean
safeBrowsingProtectionLevel:
$ref: '#/components/schemas/SafeBrowsingProtectionLevel'
screenLockSecured:
description: Indicates whether the device is password-protected
type: boolean
secureBootEnabled:
description: Indicates whether the device's startup software has its Secure
Boot feature enabled
type: boolean
siteIsolationEnabled:
description: Indicates whether the Site Isolation (also known as **Site
Per Process**) setting is enabled
type: boolean
thirdPartyBlockingEnabled:
description: Indicates whether Chrome is blocking third-party software injection
type: boolean
windowsMachineDomain:
description: Windows domain that the current machine has joined
type: string
windowsUserDomain:
description: Windows domain for the current OS user
type: string
type: object
DateTime:
description: "An [ISO-8601](https://en.wikipedia.org/wiki/ISO_8601#Combined_date_and_time_representations)\
\ formatted date and time."
example: 2024-12-01T00:00:00Z
format: date-time
type: string
DefaultApp:
example:
appInstanceId: appInstanceId
appLinkName: appLinkName
classicApplicationUri: classicApplicationUri
properties:
appInstanceId:
description: ID for the App instance
type: string
appLinkName:
description: Name for the app instance
type: string
classicApplicationUri:
description: Application URI for classic Orgs
type: string
type: object
DesktopMFAEnforceNumberMatchingChallengeOrgSetting:
properties:
desktopMFAEnforceNumberMatchingChallengeEnabled:
default: false
description: Indicates whether or not the Desktop MFA Enforce Number Matching
Challenge push notifications feature is enabled
type: boolean
type: object
DesktopMFARecoveryPinOrgSetting:
example:
desktopMFARecoveryPinEnabled: false
properties:
desktopMFARecoveryPinEnabled:
default: false
description: Indicates whether or not the Desktop MFA Recovery PIN feature
is enabled
type: boolean
type: object
DetailedHookKeyInstance:
description: A key object with public key details
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
kty: kty
e: e
use: use
kid: kid
alg: alg
"n": "n"
created: 2000-01-23T04:56:07.000+00:00
name: name
keyId: keyId
id: id
isUsed: isUsed
properties:
created:
description: Timestamp when the key was created
format: date-time
nullable: true
readOnly: true
type: string
id:
description: The unique Okta ID of this key record
nullable: false
readOnly: true
type: string
isUsed:
description: Whether this key is currently in use by other applications
format: boolean
nullable: false
readOnly: true
type: string
keyId:
description: The alias of the public key
nullable: false
readOnly: true
type: string
lastUpdated:
description: Timestamp when the key was updated
format: date-time
nullable: true
readOnly: true
type: string
name:
description: Display name of the key
maxLength: 255
minLength: 1
nullable: false
readOnly: false
type: string
_embedded:
$ref: '#/components/schemas/_embedded'
title: DetailedHookKeyInstance
type: object
DetectedRiskEvents:
enum:
- ADMIN_REPORTED_USER_RISK
- BRUTE_FORCE_ATTACK
- ENTITY_CRITICAL_ACTION_FROM_HIGH_THREAT_IP
- OKTA_THREAT_INTELLIGENCE
- SECURITY_EVENTS_PROVIDER_REPORTED_RISK
- SESSION_INFLUENCED_USER_RISK
- SUSPICIOUS_APP_ACCESS
- USER_REPORTED_SUSPICIOUS_ACTIVITY
type: string
Device:
example:
resourceAlternateId: resourceAlternateId
lastUpdated: 2000-01-23T04:56:07.000+00:00
resourceDisplayName:
sensitive: true
value: value
resourceId: resourceId
_links:
suspend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
unsuspend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users: ""
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
meid: meid
serialNumber: serialNumber
displayName: displayName
registered: true
integrityJailbreak: true
platform: ANDROID
manufacturer: manufacturer
sid: sid
osVersion: osVersion
imei: imei
diskEncryptionType: ALL_INTERNAL_VOLUMES
model: model
udid: udid
secureHardwarePresent: true
tpmPublicKeyHash: tpmPublicKeyHash
id: id
resourceType: UDDevice
status: ACTIVE
properties:
created:
description: Timestamp when the device was created
format: date-time
readOnly: true
type: string
id:
description: Unique key for the device
readOnly: true
type: string
lastUpdated:
description: "Timestamp when the device record was last updated. Updates\
\ occur when Okta collects and saves device signals during authentication,\
\ and when the lifecycle state of the device changes."
format: date-time
readOnly: true
type: string
profile:
$ref: '#/components/schemas/DeviceProfile'
resourceAlternateId:
readOnly: true
type: string
resourceDisplayName:
$ref: '#/components/schemas/DeviceDisplayName'
resourceId:
description: Alternate key for the `id`
readOnly: true
type: string
resourceType:
default: UDDevice
readOnly: true
type: string
status:
$ref: '#/components/schemas/DeviceStatus'
_links:
$ref: '#/components/schemas/LinksSelfAndFullUsersLifecycle'
type: object
DeviceAccessPolicyRuleCondition:
description: <x-lifecycle class="oie"></x-lifecycle> Specifies the device condition
to match on
properties:
assurance:
$ref: '#/components/schemas/DevicePolicyRuleConditionAssurance'
managed:
description: Indicates if the device is managed. A device is considered
managed if it's part of a device management system.
type: boolean
registered:
description: |
Indicates if the device is registered. A device is registered if the User enrolls with Okta Verify that's installed on the device.
When the `managed` property is passed, you must also include the `registered` property and set it to `true`.
type: boolean
type: object
DeviceAssurance:
discriminator:
mapping:
WINDOWS: '#/components/schemas/DeviceAssuranceWindowsPlatform'
MACOS: '#/components/schemas/DeviceAssuranceMacOSPlatform'
CHROMEOS: '#/components/schemas/DeviceAssuranceChromeOSPlatform'
IOS: '#/components/schemas/DeviceAssuranceIOSPlatform'
ANDROID: '#/components/schemas/DeviceAssuranceAndroidPlatform'
propertyName: platform
example:
lastUpdatedBy: lastUpdatedBy
createdDate: createdDate
createdBy: createdBy
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
lastUpdate: lastUpdate
name: name
id: id
platform: ANDROID
properties:
createdBy:
readOnly: true
type: string
createdDate:
readOnly: true
type: string
id:
readOnly: true
type: string
lastUpdate:
readOnly: true
type: string
lastUpdatedBy:
readOnly: true
type: string
name:
description: Display name of the Device Assurance Policy
type: string
platform:
$ref: '#/components/schemas/Platform'
_links:
$ref: '#/components/schemas/LinksSelf'
title: DeviceAssurance
type: object
DeviceAssuranceAndroidPlatform:
allOf:
- $ref: '#/components/schemas/DeviceAssurance'
- properties:
diskEncryptionType:
$ref: '#/components/schemas/DeviceAssuranceAndroidPlatform_allOf_diskEncryptionType'
jailbreak:
type: boolean
osVersion:
$ref: '#/components/schemas/OSVersion'
screenLockType:
$ref: '#/components/schemas/DeviceAssuranceAndroidPlatform_allOf_screenLockType'
secureHardwarePresent:
type: boolean
type: object
DeviceAssuranceChromeOSPlatform:
allOf:
- $ref: '#/components/schemas/DeviceAssurance'
- properties:
thirdPartySignalProviders:
$ref: '#/components/schemas/DeviceAssuranceChromeOSPlatform_allOf_thirdPartySignalProviders'
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceIOSPlatform:
allOf:
- $ref: '#/components/schemas/DeviceAssurance'
- properties:
jailbreak:
type: boolean
osVersion:
$ref: '#/components/schemas/OSVersion'
screenLockType:
$ref: '#/components/schemas/DeviceAssuranceAndroidPlatform_allOf_screenLockType'
type: object
DeviceAssuranceMacOSPlatform:
allOf:
- $ref: '#/components/schemas/DeviceAssurance'
- properties:
diskEncryptionType:
$ref: '#/components/schemas/DeviceAssuranceMacOSPlatform_allOf_diskEncryptionType'
osVersion:
$ref: '#/components/schemas/OSVersion'
screenLockType:
$ref: '#/components/schemas/DeviceAssuranceAndroidPlatform_allOf_screenLockType'
secureHardwarePresent:
type: boolean
thirdPartySignalProviders:
$ref: '#/components/schemas/DeviceAssuranceMacOSPlatform_allOf_thirdPartySignalProviders'
type: object
DeviceAssuranceWindowsPlatform:
allOf:
- $ref: '#/components/schemas/DeviceAssurance'
- properties:
diskEncryptionType:
$ref: '#/components/schemas/DeviceAssuranceMacOSPlatform_allOf_diskEncryptionType'
osVersion:
$ref: '#/components/schemas/OSVersionFourComponents'
osVersionConstraints:
description: |
<div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>Specifies the Windows version requirements for the assurance policy. Each requirement must correspond to a different major version (Windows 11 or Windows 10). If a requirement isn't specified for a major version, then devices on that major version satisfy the condition.
There are two types of OS requirements:
* **Static**: A specific Windows version requirement that doesn't change until you update the policy. A static OS Windows requirement is specified with `majorVersionConstraint` and `minimum`.
* **Dynamic**: A Windows version requirement that is relative to the latest major release and security patch. A dynamic OS Windows requirement is specified with `majorVersionConstraint` and `dynamicVersionRequirement`.
> **Note:** Dynamic OS requirements are available only if the **Dynamic OS version compliance** [self-service EA](/openapi/okta-management/guides/release-lifecycle/#early-access-ea) feature is enabled. The `osVersionConstraints` property is only supported for the Windows platform. You can't specify both `osVersion.minimum` and `osVersionConstraints` properties at the same time.
items:
$ref: '#/components/schemas/OSVersionConstraint'
maxItems: 2
minItems: 1
type: array
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
screenLockType:
$ref: '#/components/schemas/DeviceAssuranceAndroidPlatform_allOf_screenLockType'
secureHardwarePresent:
type: boolean
thirdPartySignalProviders:
$ref: '#/components/schemas/DeviceAssuranceWindowsPlatform_allOf_thirdPartySignalProviders'
type: object
DeviceCheck:
properties:
createdBy:
description: User who created the Device Check
example: 00u217pyf72CdUrBt1c5
readOnly: true
type: string
createdDate:
description: Time the Device Check was created
example: 2019-10-02T18:03:07.000Z
readOnly: true
type: string
description:
description: Description of the Device Check
example: Query macOS devices to check if firewall is enabled
type: string
id:
description: The ID of the Device Check
example: dch3m8o4rWhwReDeM1c5
readOnly: true
type: string
lastUpdate:
description: Time the Device Check was updated
example: 2019-10-02T18:03:07.000Z
readOnly: true
type: string
lastUpdatedBy:
description: User who updated the Device Check
example: 00u217pyf72CdUrBt1c5
readOnly: true
type: string
name:
description: Display name of the Device Check
example: Device Check macOS
type: string
platform:
$ref: '#/components/schemas/DeviceChecksPlatform'
query:
description: OSQuery for the Device Check
example: SELECT CASE WHEN global_state = 0 THEN 0 ELSE 1 END AS firewall_enabled
FROM alf;
type: string
variableName:
description: Unique name of the Device Check
example: macOSFirewall
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
title: DeviceCheck
type: object
DeviceChecksPlatform:
enum:
- MACOS
- WINDOWS
type: string
DeviceDisplayName:
description: Display name of the device
example:
sensitive: true
value: value
properties:
sensitive:
type: boolean
value:
type: string
type: object
DeviceList:
allOf:
- $ref: '#/components/schemas/Device'
- properties:
_embedded:
$ref: '#/components/schemas/DeviceList_allOf__embedded'
example:
resourceAlternateId: resourceAlternateId
lastUpdated: 2000-01-23T04:56:07.000+00:00
resourceDisplayName:
sensitive: true
value: value
resourceId: resourceId
_links:
suspend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
unsuspend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users: ""
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
_embedded:
users:
- managementStatus: MANAGED
created: created
screenLockType: NONE
user:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
- managementStatus: MANAGED
created: created
screenLockType: NONE
user:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
created: 2000-01-23T04:56:07.000+00:00
profile:
meid: meid
serialNumber: serialNumber
displayName: displayName
registered: true
integrityJailbreak: true
platform: ANDROID
manufacturer: manufacturer
sid: sid
osVersion: osVersion
imei: imei
diskEncryptionType: ALL_INTERNAL_VOLUMES
model: model
udid: udid
secureHardwarePresent: true
tpmPublicKeyHash: tpmPublicKeyHash
id: id
resourceType: UDDevice
status: ACTIVE
DevicePlatform:
description: OS platform of the device
enum:
- ANDROID
- IOS
- MACOS
- WINDOWS
type: string
DevicePolicyMDMFramework:
enum:
- AFW
- NATIVE
- SAFE
type: string
DevicePolicyPlatformType:
enum:
- ANDROID
- IOS
- OSX
- WINDOWS
type: string
DevicePolicyRuleCondition:
properties:
migrated:
type: boolean
platform:
$ref: '#/components/schemas/DevicePolicyRuleConditionPlatform'
rooted:
type: boolean
trustLevel:
$ref: '#/components/schemas/DevicePolicyTrustLevel'
type: object
DevicePolicyRuleConditionAssurance:
properties:
include:
items:
type: string
type: array
type: object
DevicePolicyRuleConditionPlatform:
properties:
supportedMDMFrameworks:
items:
$ref: '#/components/schemas/DevicePolicyMDMFramework'
type: array
types:
items:
$ref: '#/components/schemas/DevicePolicyPlatformType'
type: array
type: object
DevicePolicyTrustLevel:
enum:
- ANY
- TRUSTED
type: string
DeviceProfile:
example:
meid: meid
serialNumber: serialNumber
displayName: displayName
registered: true
integrityJailbreak: true
platform: ANDROID
manufacturer: manufacturer
sid: sid
osVersion: osVersion
imei: imei
diskEncryptionType: ALL_INTERNAL_VOLUMES
model: model
udid: udid
secureHardwarePresent: true
tpmPublicKeyHash: tpmPublicKeyHash
properties:
diskEncryptionType:
$ref: '#/components/schemas/DiskEncryptionTypeDef'
displayName:
description: Display name of the device
maxLength: 255
minLength: 1
type: string
imei:
description: International Mobile Equipment Identity (IMEI) of the device
maxLength: 17
minLength: 14
type: string
integrityJailbreak:
description: Indicates if the device is jailbroken or rooted. Only applicable
to `IOS` and `ANDROID` platforms
type: boolean
manufacturer:
description: Name of the manufacturer of the device
maxLength: 127
type: string
meid:
description: Mobile equipment identifier of the device
maxLength: 14
type: string
model:
description: Model of the device
maxLength: 127
type: string
osVersion:
description: Version of the device OS
maxLength: 127
type: string
platform:
$ref: '#/components/schemas/DevicePlatform'
registered:
description: Indicates if the device is registered at Okta
type: boolean
secureHardwarePresent:
description: Indicates if the device contains a secure hardware functionality
type: boolean
serialNumber:
description: Serial number of the device
maxLength: 127
type: string
sid:
description: Windows Security identifier of the device
maxLength: 256
type: string
tpmPublicKeyHash:
description: Windows Trusted Platform Module hash value
type: string
udid:
description: macOS Unique Device identifier of the device
maxLength: 47
type: string
required:
- displayName
- platform
- registered
type: object
DeviceStatus:
description: The state object of the device
enum:
- ACTIVE
- DEACTIVATED
- SUSPENDED
- UNSUSPENDED
type: string
x-enumDescriptions:
ACTIVE: Use activated devices to create and delete Device user links
DEACTIVATED: Deactivation causes a Device to lose all device user links. Set
the Device status to DEACTIVATED before deleting it.
SUSPENDED: Use suspended devices to create and delete device user links. You
can only unsuspend or deactivate suspended devices.
UNSUSPENDED: Returns a suspended Device to ACTIVE.
DeviceUser:
example:
managementStatus: MANAGED
created: created
screenLockType: NONE
user:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
properties:
created:
description: Timestamp when device was created
type: string
managementStatus:
description: The management status of the device
enum:
- MANAGED
- NOT_MANAGED
type: string
x-enumDescriptions:
MANAGED: The device has management software installed
NOT_MANAGED: The device doesn't have management software installed
screenLockType:
description: Screen lock type of the device
enum:
- NONE
- PASSCODE
- BIOMETRIC
type: string
user:
$ref: '#/components/schemas/User'
type: object
DigestAlgorithm:
description: Algorithm used to generate the key. Only required for the PBKDF2
algorithm.
enum:
- SHA256_HMAC
- SHA512_HMAC
type: string
DiskEncryptionTypeAndroid:
enum:
- FULL
- USER
type: string
DiskEncryptionTypeDef:
description: |-
Type of encryption used on the device
> **Note:** The following values map to Disk Encryption ON: `FULL`, `USER`, `ALL_INTERNAL_VOLUMES`. All other values map to Disk Encryption OFF.
enum:
- ALL_INTERNAL_VOLUMES
- FULL
- NONE
- SYSTEM_VOLUME
- USER
type: string
x-enumDescriptions:
NONE: No encryption has been set.
FULL: Disk is fully encrypted. Only applicable to `IOS` and `ANDROID` platforms.
USER: Encryption key is tied to the user or profile. Only applicable to `ANDROID`
platform.
ALL_INTERNAL_VOLUMES: All internal disks are encrypted. Only applicable to
`WINDOWS` and `MACOS` platforms.
SYSTEM_VOLUME: Only the system volume is encrypted. Only applicable to `WINDOWS`
and `MACOS` platforms.
DiskEncryptionTypeDesktop:
enum:
- ALL_INTERNAL_VOLUMES
type: string
DomainCertificate:
description: Defines the properties of the certificate
example:
privateKey: '"-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0AAQEFAASCBKgwghSkAgEAAoIBAQC5cyk6y63iBJSW\nstgsOBqIxfO8euPHcRnyWsL9dsvnbNyOnyvcqFWxdiW3sh2cItzYtoN1Zfgj5lWG\nOVXbHxP0VaNG9fHVX3+NHP6LFHQz92BzAYQmpqi9zaP/aKJklk6LdPFbVLGhuZfm\n34+ijW9YsgLTKR2WTaZJK5QtamVVmP+VsSCla2ifFzjz2FCkMMEc/Y0zUyP+en/m\nbL71K+VnpZdlEC1s38EvjRTFKFZTKVw5wpWgCZQq/AZYj9RxR23IIuRcUJ8TQ2py\noc3kIXPWjiIarSgBlA8G9kCsxgzXP2RyLwKrIBIo+qyHweifpPYW28ipdSbPjiyp\nAMdpbGLDAgMBAAECggEAUXVfT91z6IqghhKwO8QtC5T/+fN06B8rCYSKj/FFoZL0\n0oTiLFuYwImoCadoUDQUE/Efj0rKE2LSgFHg/44IItQXE01m+5WmHmL1ADxsyoLH\nz9yDosKj7jNM7RyV8F8Bg0pL1hU+rU4rhhL/MaS0mx4eFYjC4UmcWBmXTdelSVJa\nkvXvQLT5y86bqh7tqMjM/kALTWRz5CgNJFk/ONA1yo5RTX9S7SIXimBgAvuGqP8i\nMPEhJou7U3DfzXVfvP8byqNdsZs6ZNhG3wXspl61mRyrY+51SOaNLA7Bkji7x4bH\nNw6mJI0IJTAP9oc1Z8fYeMuxT1bfuD7VOupSP0mAMQKBgQDk+KuyQkmPymeP/Wwu\nII4DUpleVzxTK9obMQQoCEEElbQ6+jTb+8ixP0bWLvBXg/rX734j7OWfn/bljWLH\nXLrSoqQZF1+XMVeY4g4wx9UuTK/D2n791zdOgQivxbIPdWL3a4ap86ar8uyMgJu8\nBLXfFBAOc+9myqUkbeO7wt0e6QKBgQDPV04jPtIJoMrggpQDNreGrANKOmsXWxj4\nOHW13QNdJ2KGQpoTdoqQ8ZmlxuA8Bf2RjHsnB2kgGVTVQR74zRib4MByhvsdhvVm\nF2LNsJoIDfqtv3c+oj13VonRUGuzUeJpwT/snyaL+jQ/ZZcYz0jDgDhIODTcFYj8\nDMSD5SHgywKBgHH6MwWuJ44TNBAiF2qyu959jGjAxf+k0ZI9iRMgYLUWjDvbdtqW\ncCWDGRDfFraJtSEuTz003GzkJPPJuIUC7OCTI1p2HxhU8ITi6itwHfdJJyk4J4TW\nT+qdIqTUpTk6tsPw23zYE3x+lS+viVZDhgEArKl1HpOthh0nMnixnH6ZAoGBAKGn\nV+xy1h9bldFk/TFkP8Jn6ki9MzGKfPVKT7vzDORcCJzU4Hu8OFy5gSmW3Mzvfrsz\n4/CR/oxgM5vwoc0pWr5thJ3GT5K93iYypX3o6q7M91zvonDa3UFl3x2qrc2pUfVS\nDhzWGJ+Z+5JSCnP1aK3EEh18dPoCcELTUYPj6X3xAoGBALAllTb3RCIaqIqk+s3Y\n6KDzikgwGM6j9lmOI2MH4XmCVym4Z40YGK5nxulDh2Ihn/n9zm13Z7ul2DJwgQSO\n0zBc7/CMOsMEBaNXuKL8Qj4enJXMtub4waQ/ywqHIdc50YaPI5Ax8dD/10h9M6Qc\nnUFLNE8pXSnsqb0eOL74f3uQ\n-----END
PRIVATE KEY-----"'
certificateChain: '"-----BEGIN CERTIFICATE-----\nMIIFPjCCBCbjAwIBAgISA7RikMltj36DkLk1DUzjwfYBMA0GCSqGSIb3DQEBCwUA\nMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\nEwJSMzAeFw0yMTEwMTExOTQ3MjRaFw0yMjAxMDkxOTQ3MjNaMCgxJjAkBgNVBAMT\nHWFuaXRhdGVzdHJhaW4uc2lnbWFuZXRjb3JwLnVzMIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEA40EsG7YrFlsH3XdZKirdKKOC7/cca5g9L4rwyA/PlfeU\nB7mJhbQI/a3yZbtY+GjHmedBx15aPtyq+NFZLOkiRCXx0k2zNIJB4yC6Jr/Yp8C2\nrXO6mrCcuqpX7SuDPBtrfdYcIg8G6m0wjj1V1p2/XR8G//CBe8I2XTaTpHsx/VC8\nMNOAA27aSbeX4Nz6TQ69rFuxRG+neUbcz2hQKwroCsCHi6iBmqRkg19Uh8315Cx2\nBUqY0JecpP42KMiktzIoSlqS9yZSuNQh1kP1tPwkEzbs/t3FrfCnnRx5RDr2pJpV\nnonL3sB3TVotS3nFgPNHCfp65O0Bg/3ZpU9IvUpcdQIDAQABo4ICVjCCAlIwDgYD\nVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNV\nHRMBAf8EAjAAMB0GA1UdDgQWBBSzWt3Dvp71cKA2Z54ESjjyM4dp+jAfBgNVHSME\nGDAWgBQULrMXt1hWy65QCUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYB\nBQUHMAGGFWh0dHA6Ly9yMy5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDov\nL3IzLmkubGVuY3Iub3JnLzAoBgNVHREEITAfgh1hbml0YXRlc3RyYWluLnNpZ21h\nbmV0Y29ycC51czBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAo\nMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQIGCisG\nAQQB1nkCBAIEgfMEgfAA7gB1AG9Tdqwx8DEZ2JkApFEV/3cVHBHZAsEAKQaNsgia\nN9kTAAABfHEcLqAAAAQDAEYwRAIgMlyQ61FjuIKDfATjz0wfkskChD0csVe0TStq\nmC7NbLACICp3CYMvvDiWt1pr5pzCwTQO8F6v0/qNjmH4mjCutAgyAHUARqVV63X6\nkSAwtaKJafTzfREsQXS+/Um4havy/HD+bUcAAAF8cRwvRAAABAMARjBEAiAZd6Vn\n7MLXT7JeIxZrfbNARrf5oCM4UAVjjJeaUhB1MwIgSLW5cVAZvkiwbQW+vIutFjBz\na8cNb/i+nM7RxFW+JPgwDQYJKoZIhvcNAQELBQADggEBAIlHZiHIuOvYFteqpwvR\n0ElqinIpkYsfI+0O5FwHBXz7vMCPGtfdlcX5M10eW3aEBo9lR59mjDMsMufbTb60\nJuSnguelkUoq4WzqjZI+2uy/FTztI5GPpXmXW3IyzbqmCWQt7u8N607g1TYLBaLL\nrbFIhl+LbTJAa//mxI6bb4l/86j/kSjht6U0OIde7ylscb+3MHobbpIWJYp8Jr1D\nubm/0glL46ExnuLbIKojLhDBnG/wHVunB0rJxGh1vPvwD75O1nSIdxuNlVcGwws+\n7wsOyPA1s0VWzrMN1olLMyIPFCwPvfCm1E8Dje1AXMpmyDlqjEoQsoMUH//GKF0S\nTgM=\n-----END
CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw\nWhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\nRW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP\nR5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx\nsxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm\nNHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg\nZ3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG\n/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC\nAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB\nAf8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA\nFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw\nAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw\nOi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB\ngt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W\nPTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl\nikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz\nCkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm\nlJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4\navAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2\nyJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O\nyK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids\nhCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+\nHlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv\nMldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX\nnLRbwHOoq7hHwg==\n-----END
CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB\nAQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC\nov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL\nwYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D\nLtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK\n4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5\nbHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y\nsR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ\nXmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4\nFQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc\nSLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql\nPRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND\nTwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw\nSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1\nc3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx\n+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB\nATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu\nb3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E\nU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu\nMA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC\n5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW\n9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG\nWCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O\nhe8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC\nDfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5\n-----END
CERTIFICATE-----"'
certificate: "\"-----BEGIN CERTIFICATE-----\\nMIIFNzCCBB+gAwIBAgHTAAXomJWRama3ypu8TIxdA9wzMA0GCSqGSIb3DQEBCwUA\\\
nMDIzCzAJCgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\\nEwJSMzAeFw0yMTAyMTAwNTEzMDVaFw0yMTA1MTEwNTEzMDVaMCQxIjAgBgNVBAMT\\\
nGWFuaXRhdGVzdC5zaWdtYW5ldGNvcnAudXMwggEiMA0GCSqGSIb3DQEBAQUAA4IB\\nDwAwggEKAoIBAQC5cyk6x63iBJSWvtgsOBqIxfO8euPHcRnyWsL9dsvnbNyOnyvc\\\
nqFWxdiW3sh2cItzYtoN1Zfgj5lWGOVXbHxP0VaNG9fHVX3+NHP6LFHQz92BzAYQm\\npqi9zaP/aKJklk6LdPFbVLGhuZfm34+ijW9YsgLTKR2WTaZJK5QtamVVmP+VsSCl\\\
na2ifFzjz2FCkMMEc/Y0zUyP+en/mbL71K+VnpZdlEC1s38EvjRTFKFZTKVw5wpWg\\nCZQq/AZYj9RxR23IIuRcUJ8TQ2pyoc3kIXPWjiIarSgBlA8G9kCsxgzXP2RyLwKr\\\
nIBIo+qyHweifpPYW28ipdSbPjiypAMdpbGLDAgMBAAGjggJTMIICTzAOBgNVHQ8B\\nAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB\\\
n/wQCMAAwHQYDVR0OBBYEFPVZKiovtIK4Av/IBUQeLUs29pT6MB8GA1UdIwQYMBaA\\nFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcw\\\
nAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMu\\naS5sZW5jci5vcmcvMCQGA1UdEQQdMBuCGWFuaXRhdGVzdC5zaWdtYW5ldGNvcnAu\\\
ndXMwTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEF\\nBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEDBgorBgEEAdZ5AgQC\\\
nBIH0BIHxAO8AdgBc3EOS/uarRUSxXprUVuYQN/vV+kfcoXOUsl7m9scOygAAAXeK\\nkmOsAAAEAwBHMEUCIQDSudPEWXk969BT8yz3ag6BJWCMRU5tefEw9nXEQMsh5gIg\\\
nUmfGIuUlcNNI5PydVIHj+zns+SR8P7zfd3FIxW4gK0QAdQD2XJQv0XcwIhRUGAgw\\nlFaO400TGTO/3wwvIAvMTvFk4wAAAXeKkmOlAAAEAwBGMEQCIHQkr2qOGuInvonv\\\
nW4vvdI61nraax5V6SC3E0D2JSO91AiBVhpX4BBafRAh36r7l8LrxAfxBM3CjBmAC\\nq8fUrWfIWDANBgkqhkiG9w0BAQsFAAOCAQEAgGDMKXofKpDdv5kkID3s5GrKdzaj\\\
njFmb/6kyqd1E6eGXZAewCP1EF5BVvR6lBP2aRXiZ6sJVZktoIfztZnbxBGgbPHfv\\nR3iXIG6fxkklzR9Y8puPMBFadANE/QV78tIRAlyaqeSNsoxHi7ssQjHTP111B2lf\\\
n3KmuTpsruut1UesEJcPReLk/1xTkRx262wAncach5Wp+6GWWduTZYJbsNFyrK1RP\\nYQ0qYpP9wt2qR+DGaRUBG8i1XLnZS8pkyxtKhVw/a5Fowt+NqCpEBjjJiWJRSGnG\\\
nNSgRtSXq11j8O4JONi8EXe7cEtvzUiLR5PL3itsK2svtrZ9jIwQ95wOPaA==\\n-----END\
\ CERTIFICATE-----\","
type: PEM
properties:
certificate:
description: Certificate content
example: "\"-----BEGIN CERTIFICATE-----\\nMIIFNzCCBB+gAwIBAgHTAAXomJWRama3ypu8TIxdA9wzMA0GCSqGSIb3DQEBCwUA\\\
nMDIzCzAJCgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\\nEwJSMzAeFw0yMTAyMTAwNTEzMDVaFw0yMTA1MTEwNTEzMDVaMCQxIjAgBgNVBAMT\\\
nGWFuaXRhdGVzdC5zaWdtYW5ldGNvcnAudXMwggEiMA0GCSqGSIb3DQEBAQUAA4IB\\nDwAwggEKAoIBAQC5cyk6x63iBJSWvtgsOBqIxfO8euPHcRnyWsL9dsvnbNyOnyvc\\\
nqFWxdiW3sh2cItzYtoN1Zfgj5lWGOVXbHxP0VaNG9fHVX3+NHP6LFHQz92BzAYQm\\npqi9zaP/aKJklk6LdPFbVLGhuZfm34+ijW9YsgLTKR2WTaZJK5QtamVVmP+VsSCl\\\
na2ifFzjz2FCkMMEc/Y0zUyP+en/mbL71K+VnpZdlEC1s38EvjRTFKFZTKVw5wpWg\\nCZQq/AZYj9RxR23IIuRcUJ8TQ2pyoc3kIXPWjiIarSgBlA8G9kCsxgzXP2RyLwKr\\\
nIBIo+qyHweifpPYW28ipdSbPjiypAMdpbGLDAgMBAAGjggJTMIICTzAOBgNVHQ8B\\nAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB\\\
n/wQCMAAwHQYDVR0OBBYEFPVZKiovtIK4Av/IBUQeLUs29pT6MB8GA1UdIwQYMBaA\\nFBQusxe3WFbLrlAJQOYfr52LFMLGMFUGCCsGAQUFBwEBBEkwRzAhBggrBgEFBQcw\\\
nAYYVaHR0cDovL3IzLm8ubGVuY3Iub3JnMCIGCCsGAQUFBzAChhZodHRwOi8vcjMu\\naS5sZW5jci5vcmcvMCQGA1UdEQQdMBuCGWFuaXRhdGVzdC5zaWdtYW5ldGNvcnAu\\\
ndXMwTAYDVR0gBEUwQzAIBgZngQwBAgEwNwYLKwYBBAGC3xMBAQEwKDAmBggrBgEF\\nBQcCARYaaHR0cDovL2Nwcy5sZXRzZW5jcnlwdC5vcmcwggEDBgorBgEEAdZ5AgQC\\\
nBIH0BIHxAO8AdgBc3EOS/uarRUSxXprUVuYQN/vV+kfcoXOUsl7m9scOygAAAXeK\\nkmOsAAAEAwBHMEUCIQDSudPEWXk969BT8yz3ag6BJWCMRU5tefEw9nXEQMsh5gIg\\\
nUmfGIuUlcNNI5PydVIHj+zns+SR8P7zfd3FIxW4gK0QAdQD2XJQv0XcwIhRUGAgw\\nlFaO400TGTO/3wwvIAvMTvFk4wAAAXeKkmOlAAAEAwBGMEQCIHQkr2qOGuInvonv\\\
nW4vvdI61nraax5V6SC3E0D2JSO91AiBVhpX4BBafRAh36r7l8LrxAfxBM3CjBmAC\\nq8fUrWfIWDANBgkqhkiG9w0BAQsFAAOCAQEAgGDMKXofKpDdv5kkID3s5GrKdzaj\\\
njFmb/6kyqd1E6eGXZAewCP1EF5BVvR6lBP2aRXiZ6sJVZktoIfztZnbxBGgbPHfv\\nR3iXIG6fxkklzR9Y8puPMBFadANE/QV78tIRAlyaqeSNsoxHi7ssQjHTP111B2lf\\\
n3KmuTpsruut1UesEJcPReLk/1xTkRx262wAncach5Wp+6GWWduTZYJbsNFyrK1RP\\nYQ0qYpP9wt2qR+DGaRUBG8i1XLnZS8pkyxtKhVw/a5Fowt+NqCpEBjjJiWJRSGnG\\\
nNSgRtSXq11j8O4JONi8EXe7cEtvzUiLR5PL3itsK2svtrZ9jIwQ95wOPaA==\\n-----END\
\ CERTIFICATE-----\","
type: string
certificateChain:
description: Certificate chain
example: '"-----BEGIN CERTIFICATE-----\nMIIFPjCCBCbjAwIBAgISA7RikMltj36DkLk1DUzjwfYBMA0GCSqGSIb3DQEBCwUA\nMDIxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQD\nEwJSMzAeFw0yMTEwMTExOTQ3MjRaFw0yMjAxMDkxOTQ3MjNaMCgxJjAkBgNVBAMT\nHWFuaXRhdGVzdHJhaW4uc2lnbWFuZXRjb3JwLnVzMIIBIjANBgkqhkiG9w0BAQEF\nAAOCAQ8AMIIBCgKCAQEA40EsG7YrFlsH3XdZKirdKKOC7/cca5g9L4rwyA/PlfeU\nB7mJhbQI/a3yZbtY+GjHmedBx15aPtyq+NFZLOkiRCXx0k2zNIJB4yC6Jr/Yp8C2\nrXO6mrCcuqpX7SuDPBtrfdYcIg8G6m0wjj1V1p2/XR8G//CBe8I2XTaTpHsx/VC8\nMNOAA27aSbeX4Nz6TQ69rFuxRG+neUbcz2hQKwroCsCHi6iBmqRkg19Uh8315Cx2\nBUqY0JecpP42KMiktzIoSlqS9yZSuNQh1kP1tPwkEzbs/t3FrfCnnRx5RDr2pJpV\nnonL3sB3TVotS3nFgPNHCfp65O0Bg/3ZpU9IvUpcdQIDAQABo4ICVjCCAlIwDgYD\nVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNV\nHRMBAf8EAjAAMB0GA1UdDgQWBBSzWt3Dvp71cKA2Z54ESjjyM4dp+jAfBgNVHSME\nGDAWgBQULrMXt1hWy65QCUDmH6+dixTCxjBVBggrBgEFBQcBAQRJMEcwIQYIKwYB\nBQUHMAGGFWh0dHA6Ly9yMy5vLmxlbmNyLm9yZzAiBggrBgEFBQcwAoYWaHR0cDov\nL3IzLmkubGVuY3Iub3JnLzAoBgNVHREEITAfgh1hbml0YXRlc3RyYWluLnNpZ21h\nbmV0Y29ycC51czBMBgNVHSAERTBDMAgGBmeBDAECATA3BgsrBgEEAYLfEwEBATAo\nMCYGCCsGAQUFBwIBFhpodHRwOi8vY3BzLmxldHNlbmNyeXB0Lm9yZzCCAQIGCisG\nAQQB1nkCBAIEgfMEgfAA7gB1AG9Tdqwx8DEZ2JkApFEV/3cVHBHZAsEAKQaNsgia\nN9kTAAABfHEcLqAAAAQDAEYwRAIgMlyQ61FjuIKDfATjz0wfkskChD0csVe0TStq\nmC7NbLACICp3CYMvvDiWt1pr5pzCwTQO8F6v0/qNjmH4mjCutAgyAHUARqVV63X6\nkSAwtaKJafTzfREsQXS+/Um4havy/HD+bUcAAAF8cRwvRAAABAMARjBEAiAZd6Vn\n7MLXT7JeIxZrfbNARrf5oCM4UAVjjJeaUhB1MwIgSLW5cVAZvkiwbQW+vIutFjBz\na8cNb/i+nM7RxFW+JPgwDQYJKoZIhvcNAQELBQADggEBAIlHZiHIuOvYFteqpwvR\n0ElqinIpkYsfI+0O5FwHBXz7vMCPGtfdlcX5M10eW3aEBo9lR59mjDMsMufbTb60\nJuSnguelkUoq4WzqjZI+2uy/FTztI5GPpXmXW3IyzbqmCWQt7u8N607g1TYLBaLL\nrbFIhl+LbTJAa//mxI6bb4l/86j/kSjht6U0OIde7ylscb+3MHobbpIWJYp8Jr1D\nubm/0glL46ExnuLbIKojLhDBnG/wHVunB0rJxGh1vPvwD75O1nSIdxuNlVcGwws+\n7wsOyPA1s0VWzrMN1olLMyIPFCwPvfCm1E8Dje1AXMpmyDlqjEoQsoMUH//GKF0S\nTgM=\n-----END
CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFFjCCAv6gAwIBAgIRAJErCErPDBinU/bWLiWnX1owDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjAwOTA0MDAwMDAw\nWhcNMjUwOTE1MTYwMDAwWjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\nRW5jcnlwdDELMAkGA1UEAxMCUjMwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\nAoIBAQC7AhUozPaglNMPEuyNVZLD+ILxmaZ6QoinXSaqtSu5xUyxr45r+XXIo9cP\nR5QUVTVXjJ6oojkZ9YI8QqlObvU7wy7bjcCwXPNZOOftz2nwWgsbvsCUJCWH+jdx\nsxPnHKzhm+/b5DtFUkWWqcFTzjTIUu61ru2P3mBw4qVUq7ZtDpelQDRrK9O8Zutm\nNHz6a4uPVymZ+DAXXbpyb/uBxa3Shlg9F8fnCbvxK/eG3MHacV3URuPMrSXBiLxg\nZ3Vms/EY96Jc5lP/Ooi2R6X/ExjqmAl3P51T+c8B5fWmcBcUr2Ok/5mzk53cU6cG\n/kiFHaFpriV1uxPMUgP17VGhi9sVAgMBAAGjggEIMIIBBDAOBgNVHQ8BAf8EBAMC\nAYYwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUFBwMBMBIGA1UdEwEB/wQIMAYB\nAf8CAQAwHQYDVR0OBBYEFBQusxe3WFbLrlAJQOYfr52LFMLGMB8GA1UdIwQYMBaA\nFHm0WeZ7tuXkAXOACIjIGlj26ZtuMDIGCCsGAQUFBwEBBCYwJDAiBggrBgEFBQcw\nAoYWaHR0cDovL3gxLmkubGVuY3Iub3JnLzAnBgNVHR8EIDAeMBygGqAYhhZodHRw\nOi8veDEuYy5sZW5jci5vcmcvMCIGA1UdIAQbMBkwCAYGZ4EMAQIBMA0GCysGAQQB\ngt8TAQEBMA0GCSqGSIb3DQEBCwUAA4ICAQCFyk5HPqP3hUSFvNVneLKYY611TR6W\nPTNlclQtgaDqw+34IL9fzLdwALduO/ZelN7kIJ+m74uyA+eitRY8kc607TkC53wl\nikfmZW4/RvTZ8M6UK+5UzhK8jCdLuMGYL6KvzXGRSgi3yLgjewQtCPkIVz6D2QQz\nCkcheAmCJ8MqyJu5zlzyZMjAvnnAT45tRAxekrsu94sQ4egdRCnbWSDtY7kh+BIm\nlJNXoB1lBMEKIq4QDUOXoRgffuDghje1WrG9ML+Hbisq/yFOGwXD9RiX8F6sw6W4\navAuvDszue5L3sz85K+EC4Y/wFVDNvZo4TYXao6Z0f+lQKc0t8DQYzk1OXVu8rp2\nyJMC6alLbBfODALZvYH7n7do1AZls4I9d1P4jnkDrQoxB3UqQ9hVl3LEKQ73xF1O\nyK5GhDDX8oVfGKF5u+decIsH4YaTw7mP3GFxJSqv3+0lUFJoi5Lc5da149p90Ids\nhCExroL1+7mryIkXPeFM5TgO9r0rvZaBFOvV2z0gp35Z0+L4WPlbuEjN/lxPFin+\nHlUjr8gRsI3qfJOQFy/9rKIJR0Y/8Omwt/8oTWgy1mdeHmmjk7j1nYsvC9JSQ6Zv\nMldlTTKB3zhThV1+XWYp6rjd5JW1zbVWEkLNxE7GJThEUG3szgBVGP7pSWTUTsqX\nnLRbwHOoq7hHwg==\n-----END
CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIFYDCCBEigAwIBAgIQQAF3ITfU6UK47naqPGQKtzANBgkqhkiG9w0BAQsFADA/\nMSQwIgYDVQQKExtEaWdpdGFsIFNpZ25hdHVyZSBUcnVzdCBDby4xFzAVBgNVBAMT\nDkRTVCBSb290IENBIFgzMB4XDTIxMDEyMDE5MTQwM1oXDTI0MDkzMDE4MTQwM1ow\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwggIiMA0GCSqGSIb3DQEB\nAQUAA4ICDwAwggIKAoICAQCt6CRz9BQ385ueK1coHIe+3LffOJCMbjzmV6B493XC\nov71am72AE8o295ohmxEk7axY/0UEmu/H9LqMZshftEzPLpI9d1537O4/xLxIZpL\nwYqGcWlKZmZsj348cL+tKSIG8+TA5oCu4kuPt5l+lAOf00eXfJlII1PoOK5PCm+D\nLtFJV4yAdLbaL9A4jXsDcCEbdfIwPPqPrt3aY6vrFk/CjhFLfs8L6P+1dy70sntK\n4EwSJQxwjQMpoOFTJOwT2e4ZvxCzSow/iaNhUd6shweU9GNx7C7ib1uYgeGJXDR5\nbHbvO5BieebbpJovJsXQEOEO3tkQjhb7t/eo98flAgeYjzYIlefiN5YNNnWe+w5y\nsR2bvAP5SQXYgd0FtCrWQemsAXaVCg/Y39W9Eh81LygXbNKYwagJZHduRze6zqxZ\nXmidf3LWicUGQSk+WT7dJvUkyRGnWqNMQB9GoZm1pzpRboY7nn1ypxIFeFntPlF4\nFQsDj43QLwWyPntKHEtzBRL8xurgUBN8Q5N0s8p0544fAQjQMNRbcTa0B7rBMDBc\nSLeCO5imfWCKoqMpgsy6vYMEG6KDA0Gh1gXxG8K28Kh8hjtGqEgqiNx2mna/H2ql\nPRmP6zjzZN7IKw0KKP/32+IVQtQi0Cdd4Xn+GOdwiK1O5tmLOsbdJ1Fu/7xk9TND\nTwIDAQABo4IBRjCCAUIwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAQYw\nSwYIKwYBBQUHAQEEPzA9MDsGCCsGAQUFBzAChi9odHRwOi8vYXBwcy5pZGVudHJ1\nc3QuY29tL3Jvb3RzL2RzdHJvb3RjYXgzLnA3YzAfBgNVHSMEGDAWgBTEp7Gkeyxx\n+tvhS5B1/8QVYIWJEDBUBgNVHSAETTBLMAgGBmeBDAECATA/BgsrBgEEAYLfEwEB\nATAwMC4GCCsGAQUFBwIBFiJodHRwOi8vY3BzLnJvb3QteDEubGV0c2VuY3J5cHQu\nb3JnMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9jcmwuaWRlbnRydXN0LmNvbS9E\nU1RST09UQ0FYM0NSTC5jcmwwHQYDVR0OBBYEFHm0WeZ7tuXkAXOACIjIGlj26Ztu\nMA0GCSqGSIb3DQEBCwUAA4IBAQAKcwBslm7/DlLQrt2M51oGrS+o44+/yQoDFVDC\n5WxCu2+b9LRPwkSICHXM6webFGJueN7sJ7o5XPWioW5WlHAQU7G75K/QosMrAdSW\n9MUgNTP52GE24HGNtLi1qoJFlcDyqSMo59ahy2cI2qBDLKobkx/J3vWraV0T9VuG\nWCLKTVXkcGdtwlfFRjlBz4pYg1htmf5X6DYO8A4jqv2Il9DjXA6USbW1FzXSLr9O\nhe8Y4IWS6wY7bCkjCWDcRQJMEhg76fsO3txE+FiYruq9RUWhiF1myv4Q6W+CyBFC\nDfvp7OOGAN6dEOM4+qR9sdjoSYKEBpsr6GtPAQw4dy753ec5\n-----END
CERTIFICATE-----"'
type: string
privateKey:
description: Certificate private key
example: '"-----BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0AAQEFAASCBKgwghSkAgEAAoIBAQC5cyk6y63iBJSW\nstgsOBqIxfO8euPHcRnyWsL9dsvnbNyOnyvcqFWxdiW3sh2cItzYtoN1Zfgj5lWG\nOVXbHxP0VaNG9fHVX3+NHP6LFHQz92BzAYQmpqi9zaP/aKJklk6LdPFbVLGhuZfm\n34+ijW9YsgLTKR2WTaZJK5QtamVVmP+VsSCla2ifFzjz2FCkMMEc/Y0zUyP+en/m\nbL71K+VnpZdlEC1s38EvjRTFKFZTKVw5wpWgCZQq/AZYj9RxR23IIuRcUJ8TQ2py\noc3kIXPWjiIarSgBlA8G9kCsxgzXP2RyLwKrIBIo+qyHweifpPYW28ipdSbPjiyp\nAMdpbGLDAgMBAAECggEAUXVfT91z6IqghhKwO8QtC5T/+fN06B8rCYSKj/FFoZL0\n0oTiLFuYwImoCadoUDQUE/Efj0rKE2LSgFHg/44IItQXE01m+5WmHmL1ADxsyoLH\nz9yDosKj7jNM7RyV8F8Bg0pL1hU+rU4rhhL/MaS0mx4eFYjC4UmcWBmXTdelSVJa\nkvXvQLT5y86bqh7tqMjM/kALTWRz5CgNJFk/ONA1yo5RTX9S7SIXimBgAvuGqP8i\nMPEhJou7U3DfzXVfvP8byqNdsZs6ZNhG3wXspl61mRyrY+51SOaNLA7Bkji7x4bH\nNw6mJI0IJTAP9oc1Z8fYeMuxT1bfuD7VOupSP0mAMQKBgQDk+KuyQkmPymeP/Wwu\nII4DUpleVzxTK9obMQQoCEEElbQ6+jTb+8ixP0bWLvBXg/rX734j7OWfn/bljWLH\nXLrSoqQZF1+XMVeY4g4wx9UuTK/D2n791zdOgQivxbIPdWL3a4ap86ar8uyMgJu8\nBLXfFBAOc+9myqUkbeO7wt0e6QKBgQDPV04jPtIJoMrggpQDNreGrANKOmsXWxj4\nOHW13QNdJ2KGQpoTdoqQ8ZmlxuA8Bf2RjHsnB2kgGVTVQR74zRib4MByhvsdhvVm\nF2LNsJoIDfqtv3c+oj13VonRUGuzUeJpwT/snyaL+jQ/ZZcYz0jDgDhIODTcFYj8\nDMSD5SHgywKBgHH6MwWuJ44TNBAiF2qyu959jGjAxf+k0ZI9iRMgYLUWjDvbdtqW\ncCWDGRDfFraJtSEuTz003GzkJPPJuIUC7OCTI1p2HxhU8ITi6itwHfdJJyk4J4TW\nT+qdIqTUpTk6tsPw23zYE3x+lS+viVZDhgEArKl1HpOthh0nMnixnH6ZAoGBAKGn\nV+xy1h9bldFk/TFkP8Jn6ki9MzGKfPVKT7vzDORcCJzU4Hu8OFy5gSmW3Mzvfrsz\n4/CR/oxgM5vwoc0pWr5thJ3GT5K93iYypX3o6q7M91zvonDa3UFl3x2qrc2pUfVS\nDhzWGJ+Z+5JSCnP1aK3EEh18dPoCcELTUYPj6X3xAoGBALAllTb3RCIaqIqk+s3Y\n6KDzikgwGM6j9lmOI2MH4XmCVym4Z40YGK5nxulDh2Ihn/n9zm13Z7ul2DJwgQSO\n0zBc7/CMOsMEBaNXuKL8Qj4enJXMtub4waQ/ywqHIdc50YaPI5Ax8dD/10h9M6Qc\nnUFLNE8pXSnsqb0eOL74f3uQ\n-----END
PRIVATE KEY-----"'
type: string
type:
$ref: '#/components/schemas/DomainCertificateType'
required:
- certificate
- certificateChain
- privateKey
- type
type: object
DomainCertificateMetadata:
description: Certificate metadata for the domain
example:
subject: CN=login.example.com
fingerprint: 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4
expiration: 2021-05-11T05:13:05.000Z
properties:
expiration:
description: Certificate expiration
example: 2021-05-11T05:13:05.000Z
type: string
fingerprint:
description: Certificate fingerprint
example: 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4
type: string
subject:
description: Certificate subject
example: CN=login.example.com
type: string
type: object
DomainCertificateSourceType:
description: Certificate source type that indicates whether the certificate
is provided by the user or Okta.
enum:
- MANUAL
- OKTA_MANAGED
type: string
DomainCertificateType:
description: Certificate type
enum:
- PEM
type: string
DomainLinks:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
brand:
$ref: '#/components/schemas/DomainLinks_allOf_brand'
certificate:
$ref: '#/components/schemas/DomainLinks_allOf_certificate'
verify:
$ref: '#/components/schemas/DomainLinks_allOf_verify'
type: object
example:
certificate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
brand:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
DomainListResponse:
description: Defines a list of domains with a subset of the properties for each
domain.
example:
domains:
- _links:
certificate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
brand:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
certificateSourceType: MANUAL
brandId: bndul904tTZ6kWVhP0g3
dnsRecords:
- fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
- fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
domain: login.example.com
publicCertificate:
subject: CN=login.example.com
fingerprint: 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4
expiration: 2021-05-11T05:13:05.000Z
id: OcDz6iRyjkaCTXkdo0g3
validationStatus: VERIFIED
- _links:
certificate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
brand:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
certificateSourceType: MANUAL
brandId: bndul904tTZ6kWVhP0g3
dnsRecords:
- fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
- fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
domain: login.example.com
publicCertificate:
subject: CN=login.example.com
fingerprint: 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4
expiration: 2021-05-11T05:13:05.000Z
id: OcDz6iRyjkaCTXkdo0g3
validationStatus: VERIFIED
properties:
domains:
description: Each element of the array defines an individual domain.
items:
$ref: '#/components/schemas/DomainResponse'
type: array
type: object
DomainRequest:
example:
certificateSourceType: MANUAL
domain: login.example.com
properties:
certificateSourceType:
$ref: '#/components/schemas/DomainCertificateSourceType'
domain:
description: Custom domain name
example: login.example.com
type: string
required:
- certificateSourceType
- domain
type: object
DomainResponse:
description: The properties that define an individual domain.
example:
_links:
certificate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
brand:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
certificateSourceType: MANUAL
brandId: bndul904tTZ6kWVhP0g3
dnsRecords:
- fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
- fqdn: _oktaverification.login.example.com
recordType: TXT
values:
- 79496f234c814638b1cc44f51a782781
expiration: expiration
domain: login.example.com
publicCertificate:
subject: CN=login.example.com
fingerprint: 73:68:82:7B:83:2E:48:29:A5:5E:E8:40:41:80:B3:AA:03:C4:42:43:05:73:45:BC:AA:47:00:23:A3:70:E5:C4
expiration: 2021-05-11T05:13:05.000Z
id: OcDz6iRyjkaCTXkdo0g3
validationStatus: VERIFIED
properties:
brandId:
description: The ID number of the brand
example: bndul904tTZ6kWVhP0g3
type: string
certificateSourceType:
$ref: '#/components/schemas/DomainCertificateSourceType'
dnsRecords:
items:
$ref: '#/components/schemas/DNSRecord'
type: array
domain:
description: Custom domain name
example: login.example.com
type: string
id:
description: Unique ID of the domain
example: OcDz6iRyjkaCTXkdo0g3
type: string
publicCertificate:
$ref: '#/components/schemas/DomainCertificateMetadata'
validationStatus:
$ref: '#/components/schemas/DomainValidationStatus'
_links:
$ref: '#/components/schemas/DomainLinks'
type: object
DomainValidationStatus:
description: Status of the domain
enum:
- COMPLETED
- IN_PROGRESS
- NOT_STARTED
- VERIFIED
example: VERIFIED
type: string
Duration:
properties:
number:
type: integer
unit:
type: string
type: object
DynamicNetworkZone:
allOf:
- $ref: '#/components/schemas/NetworkZone'
- title: Dynamic Network Zone
- properties:
asns:
$ref: '#/components/schemas/DynamicNetworkZone_allOf_asns'
proxyType:
description: The proxy type used for a Dynamic Network Zone
enum:
- "null"
- Any
- Tor
- NotTorAnonymizer
type: string
x-enumDescriptions:
"null": (Or `""`) No proxy used
Any: Use any proxy type for the Dynamic Zone.
Tor: Use Tor Anonymizer proxy for the Dynamic Zone.
NotTorAnonymizer: Use a non Tor Anonymizer proxy for the Dynamic Zone.
locations:
$ref: '#/components/schemas/DynamicNetworkZone_allOf_locations'
type: object
ECKeyJWK:
description: "Elliptic Curve Key in JWK format, currently used during enrollment\
\ to encrypt fulfillment requests to Yubico, or during activation to verify\
\ Yubico's JWS objects in fulfillment responses. The currently agreed protocol\
\ uses P-384."
example:
kty: EC
crv: P-384
use: enc
kid: kid
x: x
"y": "y"
properties:
crv:
enum:
- P-384
type: string
kid:
description: The unique identifier of the key
type: string
kty:
description: The type of public key
enum:
- EC
type: string
use:
description: The intended use for the key. The ECKeyJWK is always `enc`
because Okta uses it to encrypt requests to Yubico.
enum:
- enc
type: string
x:
description: The public x coordinate for the elliptic curve point
type: string
"y":
description: The public y coordinate for the elliptic curve point
type: string
required:
- crv
- kid
- kty
- use
- x
- "y"
type: object
EmailContent:
properties:
body:
description: "The HTML body of the email. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references).\
\ \n\n<x-lifecycle class=\"ea\"></x-lifecycle> Not required if Custom\
\ languages for Okta Email Templates is enabled. A `null` body is replaced\
\ with a default value from one of the following in priority order:\n\n\
1. An existing default email customization, if one exists\n2. Okta-provided\
\ translated content for the specified language, if one exists\n3. Okta-provided\
\ translated content for the brand locale, if it's set \n4. Okta-provided\
\ content in English\n"
type: string
subject:
description: |
The email subject. May contain [variable references](https://velocity.apache.org/engine/1.7/user-guide.html#references).
<x-lifecycle class="ea"></x-lifecycle> Not required if Custom languages for Okta Email Templates is enabled. A `null` subject is replaced with a default value from one of the following in priority order:
1. An existing default email customization, if one exists
2. Okta-provided translated content for the specified language, if one exists
3. Okta-provided translated content for the brand locale, if it's set
4. Okta-provided content in English
type: string
required:
- body
- subject
type: object
EmailCustomization:
allOf:
- $ref: '#/components/schemas/EmailContent'
- properties:
created:
description: The UTC time at which this email customization was created.
format: date-time
readOnly: true
type: string
id:
description: A unique identifier for this email customization
readOnly: true
type: string
isDefault:
description: Whether this is the default customization for the email template.
Each customized email template must have exactly one default customization.
Defaults to `true` for the first customization and `false` thereafter.
type: boolean
language:
$ref: '#/components/schemas/Language'
lastUpdated:
description: The UTC time at which this email customization was last updated.
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/EmailCustomization_allOf__links'
required:
- language
type: object
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
isDefault: true
_links:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
preview:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
test:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
subject: subject
created: 2000-01-23T04:56:07.000+00:00
language: null
id: id
body: body
EmailDefaultContent:
allOf:
- $ref: '#/components/schemas/EmailContent'
- properties:
_links:
$ref: '#/components/schemas/EmailDefaultContent_allOf__links'
type: object
example:
_links: null
subject: subject
body: body
EmailDomain:
allOf:
- $ref: '#/components/schemas/BaseEmailDomain'
example:
brandId: brandId
domain: domain
validationSubdomain: mail
properties:
brandId:
type: string
domain:
type: string
validationSubdomain:
default: mail
description: Subdomain for the email sender's custom mail domain. Specify
your subdomain when you configure a custom mail domain.
type: string
required:
- brandId
- domain
type: object
EmailDomainDNSRecord:
example:
fqdn: fqdn
recordType: CNAME
verificationValue: verificationValue
properties:
fqdn:
type: string
recordType:
$ref: '#/components/schemas/EmailDomainDNSRecordType'
verificationValue:
type: string
type: object
EmailDomainDNSRecordType:
enum:
- CNAME
- TXT
type: string
EmailDomainResponse:
allOf:
- $ref: '#/components/schemas/BaseEmailDomain'
example:
dnsValidationRecords:
- fqdn: fqdn
recordType: CNAME
verificationValue: verificationValue
- fqdn: fqdn
recordType: CNAME
verificationValue: verificationValue
domain: domain
id: id
validationSubdomain: mail
validationStatus: DELETED
properties:
dnsValidationRecords:
items:
$ref: '#/components/schemas/EmailDomainDNSRecord'
type: array
domain:
type: string
id:
type: string
validationStatus:
$ref: '#/components/schemas/EmailDomainStatus'
validationSubdomain:
default: mail
description: The subdomain for the email sender's custom mail domain
type: string
type: object
EmailDomainResponseWithEmbedded:
allOf:
- $ref: '#/components/schemas/EmailDomainResponse'
example:
_embedded: "{}"
properties:
_embedded:
properties:
brands:
items:
$ref: '#/components/schemas/Brand'
type: array
readOnly: true
type: object
type: object
EmailDomainStatus:
enum:
- DELETED
- ERROR
- NOT_STARTED
- POLLING
- VERIFIED
type: string
EmailPreview:
example:
_links:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
contentSource:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
defaultContent:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
test:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
subject: subject
body: body
properties:
body:
description: The email's HTML body
readOnly: true
type: string
subject:
description: The email's subject
readOnly: true
type: string
_links:
$ref: '#/components/schemas/EmailPreview__links'
type: object
EmailServerListResponse:
example:
email-servers:
- port: 587
host: 192.168.160.1
alias: CustomServer1
id: id
enabled: true
username: aUser
- port: 587
host: 192.168.160.1
alias: CustomServer1
id: id
enabled: true
username: aUser
properties:
email-servers:
items:
$ref: '#/components/schemas/EmailServerResponse'
type: array
type: object
EmailServerPost:
allOf:
- $ref: '#/components/schemas/EmailServerRequest'
- required:
- alias
- host
- password
- port
- username
example:
password: password
port: 587
host: 192.168.160.1
alias: CustomServer1
enabled: true
username: aUser
EmailServerRequest:
allOf:
- $ref: '#/components/schemas/BaseEmailServer'
- properties:
password:
description: Password used to access your SMTP server
type: string
example:
password: password
port: 587
host: 192.168.160.1
alias: CustomServer1
enabled: true
username: aUser
EmailServerResponse:
allOf:
- $ref: '#/components/schemas/BaseEmailServer'
- properties:
id:
description: ID of your SMTP server
type: string
example:
port: 587
host: 192.168.160.1
alias: CustomServer1
id: id
enabled: true
username: aUser
EmailSettings:
example:
recipients: ALL_USERS
properties:
recipients:
enum:
- ALL_USERS
- ADMINS_ONLY
- NO_USERS
type: string
required:
- recipients
type: object
EmailSettingsResponse:
example:
_links:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
recipients: ALL_USERS
properties:
recipients:
enum:
- ALL_USERS
- ADMINS_ONLY
- NO_USERS
type: string
_links:
$ref: '#/components/schemas/EmailSettingsResponse__links'
type: object
EmailTemplateResponse:
example:
_embedded:
customizationCount: 0
settings:
_links:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
recipients: ALL_USERS
_links:
settings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
defaultContent:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
test:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
customizations:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
properties:
name:
description: The name of this email template
readOnly: true
type: string
_embedded:
$ref: '#/components/schemas/EmailTemplateResponse__embedded'
_links:
$ref: '#/components/schemas/EmailTemplateResponse__links'
type: object
EmailTemplateTouchPointVariant:
default: OKTA_DEFAULT
description: |
Variant for email templates. You can publish a theme for email templates with different combinations of assets. Variants are preset combinations of those assets.
enum:
- FULL_THEME
- OKTA_DEFAULT
type: string
x-enumDescriptions:
FULL_THEME: Uses the Okta logo and Okta colors in email templates
OKTA_DEFAULT: Uses the logo from the Theme. Uses `primaryColorHex` as the
background color for buttons.
EmailTestAddresses:
example:
from: sender@host.com
to: receiver@host.com
properties:
from:
description: Email address that sends test emails
example: sender@host.com
type: string
to:
description: Email address that receives test emails
example: receiver@host.com
type: string
required:
- from
- to
type: object
EnabledStatus:
description: Setting status
enum:
- DISABLED
- ENABLED
type: string
EndUserDashboardTouchPointVariant:
default: OKTA_DEFAULT
description: |
Variant for the Okta End-User Dashboard. You can publish a theme for end-user dashboard with different combinations of assets. Variants are preset combinations of those assets.
enum:
- FULL_THEME
- LOGO_ON_FULL_WHITE_BACKGROUND
- OKTA_DEFAULT
- WHITE_LOGO_BACKGROUND
type: string
x-enumDescriptions:
FULL_THEME: Uses the logo and favicon from the Theme. Uses `primaryColorHex`
for the logo and the side navigation bar background color.
LOGO_ON_FULL_WHITE_BACKGROUND: Uses the logo and favicon from the Theme. Uses
white background color for the logo and the side navigation bar background
color.
OKTA_DEFAULT: Uses the Okta logo and favicon. Uses a white background color
for the logo and the side navigation bar background color.
WHITE_LOGO_BACKGROUND: "Uses the logo and favicon from the Theme, with a white\
\ background color for the logo. Uses `primaryColorHex` for the side navigation\
\ bar background color."
EndpointAuthMethod:
description: Requested authentication method for OAuth 2.0 endpoints.
enum:
- client_secret_basic
- client_secret_jwt
- client_secret_post
- none
- private_key_jwt
type: string
EnhancedDynamicNetworkZone:
allOf:
- $ref: '#/components/schemas/NetworkZone'
- title: Enhanced Dynamic Network Zone
- properties:
asns:
$ref: '#/components/schemas/EnhancedDynamicNetworkZone_allOf_asns'
locations:
$ref: '#/components/schemas/EnhancedDynamicNetworkZone_allOf_locations'
ipServiceCategories:
$ref: '#/components/schemas/EnhancedDynamicNetworkZone_allOf_ipServiceCategories'
type: object
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
EnrollmentActivationRequest:
description: Enrollment Initialization Request
example:
pinResponseJwe: pinResponseJwe
fulfillmentProvider: yubico
serial: serial
yubicoSigningJwks:
- kty: EC
crv: P-384
use: enc
kid: kid
x: x
"y": "y"
- kty: EC
crv: P-384
use: enc
kid: kid
x: x
"y": "y"
credResponses:
- credResponseJWE: credResponseJWE
authenticatorEnrollmentId: authenticatorEnrollmentId
- credResponseJWE: credResponseJWE
authenticatorEnrollmentId: authenticatorEnrollmentId
userId: userId
version: version
properties:
credResponses:
description: List of credential responses from the fulfillment provider
items:
$ref: '#/components/schemas/WebAuthnCredResponse'
type: array
fulfillmentProvider:
description: Name of the fulfillment provider for the WebAuthn Preregistration
Factor
enum:
- yubico
type: string
pinResponseJwe:
description: Encrypted JWE of PIN response from the fulfillment provider
type: string
serial:
description: Serial number of the YubiKey
type: string
userId:
description: ID of an existing Okta user
type: string
version:
description: Firmware version of the YubiKey
type: string
yubicoSigningJwks:
description: List of usable signing keys from Yubico (in JWKS format) used
to verify the JWS inside the JWE
items:
$ref: '#/components/schemas/ECKeyJWK'
type: array
type: object
EnrollmentActivationResponse:
description: Enrollment Initialization Response
example:
fulfillmentProvider: yubico
authenticatorEnrollmentIds:
- authenticatorEnrollmentIds
- authenticatorEnrollmentIds
userId: userId
properties:
authenticatorEnrollmentIds:
description: List of IDs for preregistered WebAuthn Factors in Okta
items:
type: string
type: array
fulfillmentProvider:
description: Name of the fulfillment provider for the WebAuthn Preregistration
Factor
enum:
- yubico
type: string
userId:
description: ID of an existing Okta user
type: string
type: object
EnrollmentInitializationRequest:
description: Enrollment Initialization Request
example:
enrollmentRpIds:
- enrollmentRpIds
- enrollmentRpIds
fulfillmentProvider: yubico
yubicoTransportKeyJWK:
kty: EC
crv: P-384
use: enc
kid: kid
x: x
"y": "y"
userId: userId
properties:
enrollmentRpIds:
description: List of Relying Party hostnames to register on the YubiKey.
items:
type: string
type: array
fulfillmentProvider:
description: Name of the fulfillment provider for the WebAuthn Preregistration
Factor
enum:
- yubico
type: string
userId:
description: ID of an existing Okta user
type: string
yubicoTransportKeyJWK:
$ref: '#/components/schemas/ECKeyJWK'
type: object
EnrollmentInitializationResponse:
description: "Yubico Transport Key in the form of a JWK, used to encrypt our\
\ fulfillment request to Yubico. The currently agreed protocol uses P-384."
example:
pinRequestJwe: pinRequestJwe
fulfillmentProvider: yubico
credRequests:
- credRequestJwe: credRequestJwe
keyId: keyId
authenticatorEnrollmentId: authenticatorEnrollmentId
- credRequestJwe: credRequestJwe
keyId: keyId
authenticatorEnrollmentId: authenticatorEnrollmentId
userId: userId
properties:
credRequests:
description: List of credential requests for the fulfillment provider
items:
$ref: '#/components/schemas/WebAuthnCredRequest'
type: array
fulfillmentProvider:
description: Name of the fulfillment provider for the WebAuthn Preregistration
Factor
enum:
- yubico
type: string
pinRequestJwe:
description: Encrypted JWE of PIN request for the fulfillment provider
type: string
userId:
description: ID of an existing Okta user
type: string
type: object
EntitlementValue:
properties:
id:
type: string
name:
type: string
value:
type: string
_links:
$ref: '#/components/schemas/EntitlementValue__links'
type: object
EntitlementValuesResponse:
properties:
entitlementValues:
items:
$ref: '#/components/schemas/EntitlementValue'
type: array
_links:
$ref: '#/components/schemas/EntitlementValuesResponse__links'
type: object
EntityRiskPolicy:
allOf:
- $ref: '#/components/schemas/Policy'
- type: object
properties:
conditions:
description: Policy conditions aren't supported for this policy type.
nullable: true
type: string
EntityRiskPolicyRule:
allOf:
- $ref: '#/components/schemas/PolicyRule'
- properties:
actions:
$ref: '#/components/schemas/EntityRiskPolicyRule_allOf_actions'
conditions:
$ref: '#/components/schemas/EntityRiskPolicyRuleConditions'
type: object
EntityRiskPolicyRuleActionRunWorkflow:
properties:
action:
enum:
- RUN_WORKFLOW
type: string
workflow:
$ref: '#/components/schemas/EntityRiskPolicyRuleActionRunWorkflow_workflow'
type: object
EntityRiskPolicyRuleActionTerminateAllSessions:
properties:
action:
description: This action revokes or terminates all of the user's active
sessions.
enum:
- TERMINATE_ALL_SESSIONS
type: string
type: object
EntityRiskPolicyRuleActionsObject:
discriminator:
mapping:
RUN_WORKFLOW: '#/components/schemas/EntityRiskPolicyRuleActionRunWorkflow'
TERMINATE_ALL_SESSIONS: '#/components/schemas/EntityRiskPolicyRuleActionTerminateAllSessions'
propertyName: action
properties:
action:
enum:
- RUN_WORKFLOW
- TERMINATE_ALL_SESSIONS
type: string
type: object
EntityRiskPolicyRuleConditions:
allOf:
- properties:
entityRisk:
$ref: '#/components/schemas/EntityRiskScorePolicyRuleCondition'
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
riskDetectionTypes:
$ref: '#/components/schemas/RiskDetectionTypesPolicyRuleCondition'
type: object
EntityRiskScorePolicyRuleCondition:
description: <x-lifecycle class="oie"></x-lifecycle> The risk score level of
the entity risk policy rule
properties:
level:
enum:
- ANY
- LOW
- MEDIUM
- HIGH
type: string
required:
- level
type: object
Error:
example:
errorCauses:
- errorSummary: errorSummary
- errorSummary: errorSummary
errorLink: errorLink
errorCode: errorCode
errorId: errorId
errorSummary: errorSummary
properties:
errorCauses:
items:
$ref: '#/components/schemas/ErrorCause'
type: array
errorCode:
description: An Okta code for this type of error
type: string
errorId:
description: A unique identifier for this error. This can be used by Okta
Support to help with troubleshooting.
type: string
errorLink:
description: An Okta code for this type of error
type: string
errorSummary:
description: A short description of what caused this error. Sometimes this
contains dynamically-generated information about your specific error.
type: string
title: Error
type: object
ErrorCause:
example:
errorSummary: errorSummary
properties:
errorSummary:
type: string
type: object
ErrorPage:
allOf:
- $ref: '#/components/schemas/CustomizablePage'
- properties:
contentSecurityPolicySetting:
$ref: '#/components/schemas/ContentSecurityPolicySetting'
type: object
example:
contentSecurityPolicySetting:
mode: enforced
reportUri: reportUri
srcList:
- srcList
- srcList
pageContent: pageContent
ErrorPageTouchPointVariant:
default: OKTA_DEFAULT
description: |
Variant for the error page. You can publish a theme for error page with different combinations of assets. Variants are preset combinations of those assets.
enum:
- BACKGROUND_IMAGE
- BACKGROUND_SECONDARY_COLOR
- OKTA_DEFAULT
type: string
x-enumDescriptions:
BACKGROUND_IMAGE: "Uses the logo, favicon, and background image from the Theme"
BACKGROUND_SECONDARY_COLOR: Uses the logo and favicon from the Theme. Uses
`secondaryColorHex` as the background color for the error page.
OKTA_DEFAULT: "Uses the Okta logo, favicon, and background color"
ErrorResponse:
properties:
errorCause:
description: The reason or cause for the error in the org domain for the
dr operation
nullable: true
type: string
errorCode:
description: An error code unique to the error
type: string
errorId:
description: The unique identifier of this error
nullable: true
type: string
errorLink:
description: An indicator where to look out to troubleshoot the error
nullable: true
type: string
errorSummary:
description: "An error code description, detailing the error"
type: string
required:
- errorCode
- errorSummary
type: object
EventHook:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
createdBy: createdBy
verificationStatus: UNVERIFIED
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
channel:
type: HTTP
config:
headers:
- value: value
key: key
- value: value
key: key
method: method
authScheme:
type: HEADER
value: value
key: key
uri: uri
version: version
name: name
description: description
id: id
events:
filter:
eventFilterMap:
- condition:
expression: expression
version: version
event: event
- condition:
expression: expression
version: version
event: event
type: type
type: EVENT_TYPE
items:
- items
- items
status: ACTIVE
properties:
channel:
$ref: '#/components/schemas/EventHookChannel'
created:
description: Timestamp of the event hook creation
format: date-time
readOnly: true
type: string
createdBy:
description: The ID of the user who created the event hook
readOnly: true
type: string
description:
description: Description of the event hook
nullable: true
type: string
events:
$ref: '#/components/schemas/EventSubscriptions'
id:
description: Unique key for the event hook
readOnly: true
type: string
lastUpdated:
description: Date of the last event hook update
format: date-time
readOnly: true
type: string
name:
description: Display name for the event hook
type: string
status:
description: Status of the event hook
enum:
- ACTIVE
- INACTIVE
readOnly: true
type: string
verificationStatus:
$ref: '#/components/schemas/EventHookVerificationStatus'
_links:
$ref: '#/components/schemas/EventHook__links'
required:
- channel
- events
- name
type: object
EventHookChannel:
example:
type: HTTP
config:
headers:
- value: value
key: key
- value: value
key: key
method: method
authScheme:
type: HEADER
value: value
key: key
uri: uri
version: version
properties:
config:
$ref: '#/components/schemas/EventHookChannelConfig'
type:
$ref: '#/components/schemas/EventHookChannelType'
version:
description: Version of the channel. Currently the only supported version
is `1.0.0``.
type: string
required:
- config
- type
- version
type: object
EventHookChannelConfig:
example:
headers:
- value: value
key: key
- value: value
key: key
method: method
authScheme:
type: HEADER
value: value
key: key
uri: uri
properties:
authScheme:
$ref: '#/components/schemas/EventHookChannelConfigAuthScheme'
headers:
description: |-
Optional list of key/value pairs for headers that can be sent with the request to the external service. For example,
`X-Other-Header` is an example of an optional header, with a value of `my-header-value`, that you want Okta to pass to your
external service.
items:
$ref: '#/components/schemas/EventHookChannelConfigHeader'
type: array
method:
description: The method of the Okta event hook request
readOnly: true
type: string
uri:
description: The external service endpoint called to execute the event hook
handler
type: string
required:
- uri
type: object
EventHookChannelConfigAuthScheme:
description: |-
The authentication scheme used for this request.
To use Basic Auth for authentication, set `type` to `HEADER`,
`key` to `Authorization`, and `value` to the Base64-encoded string of "username:password". Ensure that you include
the scheme (including space) as part of the `value` parameter. For example, `Basic YWRtaW46c3VwZXJzZWNyZXQ=`.
example:
type: HEADER
value: value
key: key
properties:
key:
description: The name for the authorization header
type: string
type:
$ref: '#/components/schemas/EventHookChannelConfigAuthSchemeType'
value:
description: |-
The header value. This secret key is passed to your external service endpoint for security verification.
This property is not returned in the response.
type: string
writeOnly: true
type: object
EventHookChannelConfigAuthSchemeType:
description: The authentication scheme type. Currently only supports `HEADER`.
enum:
- HEADER
type: string
EventHookChannelConfigHeader:
example:
value: value
key: key
nullable: true
properties:
key:
description: The optional field or header name
type: string
value:
description: The value for the key
type: string
type: object
EventHookChannelType:
description: The channel type. Currently supports `HTTP`.
enum:
- HTTP
type: string
EventHookFilterMap:
description: The object that maps the filter to the event type
items:
$ref: '#/components/schemas/EventHookFilterMapObject'
type: array
EventHookFilterMapObject:
example:
condition:
expression: expression
version: version
event: event
properties:
condition:
$ref: '#/components/schemas/EventHookFilterMapObjectCondition'
event:
description: The filtered event type
type: string
type: object
EventHookFilterMapObjectCondition:
example:
expression: expression
version: version
properties:
expression:
description: The Okta Expression language statement that filters the event
type
type: string
version:
description: Internal field
nullable: true
readOnly: true
type: string
type: object
EventHookFilters:
description: |-
The optional filter defined on a specific event type
> **Note:** Event hook filters is a [self-service Early Access (EA)](/openapi/okta-management/guides/release-lifecycle/#early-access-ea) to enable.
If you want to disable this feature, it's recommended to first remove all event filters.
example:
eventFilterMap:
- condition:
expression: expression
version: version
event: event
- condition:
expression: expression
version: version
event: event
type: type
nullable: true
properties:
eventFilterMap:
description: The object that maps the filter to the event type
items:
$ref: '#/components/schemas/EventHookFilterMapObject'
type: array
type:
description: The type of filter. Currently only supports `EXPRESSION_LANGUAGE`
readOnly: true
type: string
type: object
EventHookSubscribedEventTypes:
description: |-
The subscribed event types that trigger the event hook. When you register an event hook
you need to specify which events you want to subscribe to. To see the list of event types
currently eligible for use in event hooks, use the [Event Types catalog](https://developer.okta.com/docs/reference/api/event-types/#catalog)
and search with the parameter `event-hook-eligible`.
items:
type: string
type: array
EventHookVerificationStatus:
description: Verification status of the event hook. `UNVERIFIED` event hooks
won't receive any events.
enum:
- UNVERIFIED
- VERIFIED
readOnly: true
type: string
EventSubscriptionType:
description: The events object type. Currently supports `EVENT_TYPE`.
enum:
- EVENT_TYPE
type: string
EventSubscriptions:
example:
filter:
eventFilterMap:
- condition:
expression: expression
version: version
event: event
- condition:
expression: expression
version: version
event: event
type: type
type: EVENT_TYPE
items:
- items
- items
properties:
filter:
$ref: '#/components/schemas/EventHookFilters'
items:
description: |-
The subscribed event types that trigger the event hook. When you register an event hook
you need to specify which events you want to subscribe to. To see the list of event types
currently eligible for use in event hooks, use the [Event Types catalog](https://developer.okta.com/docs/reference/api/event-types/#catalog)
and search with the parameter `event-hook-eligible`.
items:
type: string
type: array
type:
$ref: '#/components/schemas/EventSubscriptionType'
required:
- items
- type
type: object
ExpiresAt:
description: Timestamp when the object expires
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
Expression:
example:
value: value
properties:
value:
type: string
type: object
FCMConfiguration:
properties:
fileName:
description: (Optional) File name for Admin Console display
type: string
projectId:
description: Project ID of FCM configuration
readOnly: true
type: string
serviceAccountJson:
description: "JSON containing the private service account key and service\
\ account details. See [Creating and managing service account keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)\
\ for more information on creating service account keys in JSON."
type: object
writeOnly: true
FCMPushProvider:
allOf:
- $ref: '#/components/schemas/PushProvider'
- properties:
configuration:
$ref: '#/components/schemas/FCMConfiguration'
type: object
FailbackRequestSchema:
description: List of domains to failback
items:
description: Okta or custom domain to failback
example: yourOktaDomain.okta.com
type: string
type: array
FailbackResponseSchema:
description: successful failback message
type: string
FailoverRequestSchema:
description: List of domains to failover
items:
description: Okta or custom domain to failover
example: yourOktaDomain.okta.com
type: string
type: array
FailoverResponseSchema:
description: successful failover message
type: string
Feature:
description: Specifies feature release cycle information
example:
stage:
state: CLOSED
value: BETA
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
dependents:
href: href
dependencies:
href: href
name: name
description: description
id: id
type: self-service
status: DISABLED
properties:
description:
description: Brief description of the feature and what it provides
type: string
id:
description: Unique identifier for this feature
readOnly: true
type: string
name:
description: Name of the feature
type: string
stage:
$ref: '#/components/schemas/FeatureStage'
status:
$ref: '#/components/schemas/EnabledStatus'
type:
$ref: '#/components/schemas/FeatureType'
_links:
$ref: '#/components/schemas/Feature__links'
type: object
FeatureLifecycle:
enum:
- DISABLE
- ENABLE
example: ENABLE
type: string
FeatureStage:
description: |-
Current release cycle stage of a feature
If a feature's stage value is `EA`, the state is `null` and not returned. If the value is `BETA`, the state is `OPEN` or `CLOSED` depending on whether the `BETA` feature is manageable.
> **Note:** If a feature's stage is `OPEN BETA`, you can update it only in Preview cells. If a feature's stage is `CLOSED BETA`, you can disable it only in Preview cells.
example:
state: CLOSED
value: BETA
properties:
state:
$ref: '#/components/schemas/FeatureStageState'
value:
$ref: '#/components/schemas/FeatureStageValue'
type: object
FeatureStageState:
description: Indicates the release state of the feature
enum:
- CLOSED
- OPEN
type: string
FeatureStageValue:
description: Current release stage of the feature
enum:
- BETA
- EA
type: string
FeatureType:
description: Type of feature
enum:
- self-service
type: string
FipsEnum:
enum:
- OPTIONAL
- REQUIRED
type: string
ForgotPasswordResponse:
example:
resetPasswordUrl: resetPasswordUrl
properties:
resetPasswordUrl:
readOnly: true
type: string
type: object
FulfillmentData:
description: Fulfillment provider details
example:
customizationId: customizationId
productId: productId
inventoryProductId: inventoryProductId
properties:
customizationId:
description: ID for the set of custom configurations of the requested Factor
type: string
inventoryProductId:
description: ID for the specific inventory bucket of the requested Factor
type: string
productId:
description: ID for the make and model of the requested Factor
type: string
type: object
FulfillmentRequest:
description: Fulfillment Request
example:
fulfillmentData:
customizationId: customizationId
productId: productId
inventoryProductId: inventoryProductId
fulfillmentProvider: yubico
userId: userId
properties:
fulfillmentData:
$ref: '#/components/schemas/FulfillmentData'
fulfillmentProvider:
description: Name of the fulfillment provider for the WebAuthn Preregistration
Factor
enum:
- yubico
type: string
userId:
description: ID of an existing Okta user
type: string
type: object
GoogleApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- google
example: google
type: string
signOnMode:
enum:
- BROWSER_PLUGIN
- SAML_2_0
example: BROWSER_PLUGIN
type: string
settings:
$ref: '#/components/schemas/GoogleApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for the Google Workspace app (key name: `google`)
To create a Google Workspace app, use the [Create an Application](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Google Workspace app only supports `BROWSER_PLUGIN` and `SAML_2_0` sign-on modes.
example:
name: google
label: Sample Google App
signOnMode: SAML_2_0
settings:
app:
domain: my-company-domain
title: Google Workspace
x-tags:
- Application
x-okta-defined-as:
name: google
GoogleApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/GoogleApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
GoogleApplicationSettingsApplication:
description: Google app instance properties
properties:
domain:
description: Your Google company domain
type: string
rpId:
description: RPID
type: string
required:
- domain
type: object
GovernanceBundle:
properties:
description:
type: string
id:
type: string
name:
type: string
orn:
type: string
status:
type: string
_links:
$ref: '#/components/schemas/GovernanceBundle__links'
type: object
GovernanceBundleCreateRequest:
properties:
description:
type: string
entitlements:
items:
$ref: '#/components/schemas/IAMBundleEntitlement'
type: array
name:
type: string
type: object
GovernanceBundleUpdateRequest:
properties:
description:
type: string
entitlements:
items:
$ref: '#/components/schemas/IAMBundleEntitlement'
type: array
name:
type: string
type: object
GovernanceBundlesResponse:
properties:
bundles:
items:
$ref: '#/components/schemas/GovernanceBundle'
type: array
_links:
$ref: '#/components/schemas/GovernanceBundlesResponse__links'
type: object
GovernanceSourceType:
description: The grant type
enum:
- CUSTOM
- ENTITLEMENT-BUNDLE
type: string
GrantOrTokenStatus:
description: Status
enum:
- ACTIVE
- REVOKED
example: ACTIVE
readOnly: true
type: string
GrantResourcesHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/grants"
type: string
type: object
GrantType:
description: Determines the mechanism Okta uses to authorize the creation of
the tokens.
enum:
- authorization_code
- client_credentials
- implicit
- interaction_code
- password
- refresh_token
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:jwt-bearer
- urn:ietf:params:oauth:grant-type:saml2-bearer
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:openid:params:grant-type:ciba
- urn:okta:params:oauth:grant-type:otp
- urn:okta:params:oauth:grant-type:oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-oob
type: string
GrantTypePolicyRuleCondition:
description: Array of grant types that this condition includes. Determines the
mechanism that Okta uses to authorize the creation of the tokens.
example:
include:
- include
- include
properties:
include:
description: Array of grant types that this condition includes.
items:
type: string
type: array
type: object
Group:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
properties:
created:
description: Timestamp when the Group was created
format: date-time
readOnly: true
type: string
id:
description: Unique ID for the Group
example: 0gabcd1234
readOnly: true
type: string
lastMembershipUpdated:
description: Timestamp when the Groups memberships were last updated
format: date-time
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Group's Profile was last updated
format: date-time
readOnly: true
type: string
objectClass:
description: Determines the Group's `profile`
items:
type: string
readOnly: true
type: array
profile:
$ref: '#/components/schemas/GroupProfile'
type:
$ref: '#/components/schemas/GroupType'
_embedded:
additionalProperties:
properties: {}
type: object
description: Embedded resources related to the Group
readOnly: true
type: object
_links:
$ref: '#/components/schemas/Group__links'
type: object
GroupAssignmentProfile:
additionalProperties: true
description: "Specifies the profile properties applied to [Application Users](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/ApplicationUsers/)\
\ that are assigned to the app through group membership. \nSome reference\
\ properties are imported from the target app and can't be configured. See\
\ [profile](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/#tag/User/operation/getUser!c=200&path=profile&t=response)."
type: object
GroupCondition:
description: Specifies a set of Groups whose Users are to be included or excluded
properties:
exclude:
description: Groups to be excluded
items:
type: string
type: array
include:
description: Groups to be included
items:
type: string
type: array
required:
- exclude
- include
type: object
GroupOwner:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
originType: APPLICATION
originId: originId
displayName: displayName
id: id
type: GROUP
resolved: true
properties:
displayName:
description: The display name of the group owner
readOnly: true
type: string
id:
description: The `id` of the group owner
type: string
lastUpdated:
description: Timestamp when the group owner was last updated
format: date-time
readOnly: true
type: string
originId:
description: The ID of the app instance if the `originType` is `APPLICATION`.
This value is `NULL` if `originType` is `OKTA_DIRECTORY`.
type: string
originType:
$ref: '#/components/schemas/GroupOwnerOriginType'
resolved:
description: "If `originType`is APPLICATION, this parameter is set to `FALSE`\
\ until the owner’s `originId` is reconciled with an associated Okta ID."
type: boolean
type:
$ref: '#/components/schemas/GroupOwnerType'
type: object
GroupOwnerOriginType:
description: The source where group ownership is managed
enum:
- APPLICATION
- OKTA_DIRECTORY
type: string
GroupOwnerType:
description: The entity type of the owner
enum:
- GROUP
- USER
type: string
GroupPolicyRuleCondition:
description: Specifies a set of Groups whose Users are to be included or excluded
properties:
exclude:
description: Groups to be excluded
items:
type: string
type: array
include:
description: Groups to be included
items:
type: string
type: array
type: object
GroupProfile:
anyOf:
- $ref: '#/components/schemas/OktaUserGroupProfile'
- $ref: '#/components/schemas/OktaActiveDirectoryGroupProfile'
description: |-
Specifies required and optional properties for a Group. The `objectClass` of a Group determines which additional properties are available.
You can extend Group Profiles with custom properties, but you must first add the properties to the Group Profile schema before you can reference them. Use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/)to manage schema extensions.
Custom properties can contain HTML tags. It is the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.
GroupRule:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
created: 2000-01-23T04:56:07.000+00:00
name: name
id: id
conditions:
expression:
type: type
value: user.role==\"Engineer\"
people:
groups:
exclude:
- exclude
- exclude
users:
exclude:
- exclude
- exclude
type: type
actions:
assignUserToGroups:
groupIds:
- groupIds
- groupIds
status: ACTIVE
properties:
actions:
$ref: '#/components/schemas/GroupRuleAction'
conditions:
$ref: '#/components/schemas/GroupRuleConditions'
created:
description: Creation date for group rule
format: date-time
readOnly: true
type: string
id:
description: ID of the group rule
readOnly: true
type: string
lastUpdated:
description: Date group rule was last updated
format: date-time
readOnly: true
type: string
name:
description: Name of the Group rule
maxLength: 50
minLength: 1
type: string
status:
$ref: '#/components/schemas/GroupRuleStatus'
type:
description: Type to indicate a Group rule operation. Only `group_rule`
is allowed.
type: string
type: object
GroupRuleAction:
description: Defines which users and groups to assign
example:
assignUserToGroups:
groupIds:
- groupIds
- groupIds
properties:
assignUserToGroups:
$ref: '#/components/schemas/GroupRuleGroupAssignment'
type: object
GroupRuleConditions:
description: Defines group rule conditions
example:
expression:
type: type
value: user.role==\"Engineer\"
people:
groups:
exclude:
- exclude
- exclude
users:
exclude:
- exclude
- exclude
properties:
expression:
$ref: '#/components/schemas/GroupRuleExpression'
people:
$ref: '#/components/schemas/GroupRulePeopleCondition'
type: object
GroupRuleExpression:
description: "Defines Okta specific [group-rules expression](https://developer.okta.com/docs/reference/okta-expression-language/#expressions-in-group-rules)"
example:
type: type
value: user.role==\"Engineer\"
properties:
type:
description: Expression type. Only valid value is '`urn:okta:expression:1.0`'.
type: string
value:
description: Okta expression that would result in a Boolean value
example: user.role==\"Engineer\"
type: string
type: object
GroupRuleGroupAssignment:
description: Contains the `groupIds` array
example:
groupIds:
- groupIds
- groupIds
properties:
groupIds:
description: Array of `groupIds` to which Users are added
items:
type: string
type: array
type: object
GroupRuleGroupCondition:
description: Currently not supported
example:
exclude:
- exclude
- exclude
properties:
exclude:
description: Currently not supported
items:
type: string
type: array
type: object
GroupRulePeopleCondition:
description: Defines conditions for `people` in a group rule
example:
groups:
exclude:
- exclude
- exclude
users:
exclude:
- exclude
- exclude
properties:
groups:
$ref: '#/components/schemas/GroupRuleGroupCondition'
users:
$ref: '#/components/schemas/GroupRuleUserCondition'
type: object
GroupRuleStatus:
description: Status of group rule
enum:
- ACTIVE
- INACTIVE
- INVALID
type: string
GroupRuleUserCondition:
description: Defines conditions specific to user exclusion
example:
exclude:
- exclude
- exclude
properties:
exclude:
description: Excluded `userIds` when processing rules
items:
type: string
type: array
type: object
GroupSchema:
example:
lastUpdated: lastUpdated
$schema: $schema
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: created
name: name
description: description
id: id
title: title
type: type
definitions:
custom:
id: id
type: type
properties:
key:
minLength: 6
externalNamespace: externalNamespace
format: ""
description: description
title: title
type: ""
enum:
- GroupSchemaAttribute_enum_inner
- GroupSchemaAttribute_enum_inner
required: true
master: ""
oneOf:
- const: const
title: title
- const: const
title: title
permissions:
- principal: principal
action: action
- principal: principal
action: action
externalName: externalName
scope: ""
unique: unique
mutability: ""
items:
oneOf:
- const: const
title: title
- const: const
title: title
type: type
enum:
- enum
- enum
maxLength: 0
required:
- required
- required
base:
id: id
type: type
properties: ""
required:
- required
- required
properties:
profile:
allOf:
- $ref: $ref
- $ref: $ref
properties:
$schema:
description: JSON Schema version identifier
readOnly: true
type: string
created:
description: Timestamp when the Schema was created
readOnly: true
type: string
definitions:
$ref: '#/components/schemas/GroupSchemaDefinitions'
description:
description: Description for the Schema
type: string
id:
description: URI of Group Schema
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Schema was last updated
readOnly: true
type: string
name:
description: Name of the Schema
readOnly: true
type: string
properties:
$ref: '#/components/schemas/UserSchemaProperties'
title:
description: User-defined display name for the Schema
type: string
type:
description: "Type of [root Schema](https://tools.ietf.org/html/draft-zyp-json-schema-04#section-3.4)"
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
x-okta-allow-null-property-value-for-updates: true
GroupSchemaAttribute:
example:
minLength: 6
externalNamespace: externalNamespace
format: ""
description: description
title: title
type: ""
enum:
- GroupSchemaAttribute_enum_inner
- GroupSchemaAttribute_enum_inner
required: true
master: ""
oneOf:
- const: const
title: title
- const: const
title: title
permissions:
- principal: principal
action: action
- principal: principal
action: action
externalName: externalName
scope: ""
unique: unique
mutability: ""
items:
oneOf:
- const: const
title: title
- const: const
title: title
type: type
enum:
- enum
- enum
maxLength: 0
properties:
description:
description: Description of the property
type: string
enum:
description: |-
Enumerated value of the property.
The value of the property is limited to one of the values specified in the enum definition. The list of values for the enum must consist of unique elements.
items:
$ref: '#/components/schemas/GroupSchemaAttribute_enum_inner'
nullable: true
type: array
externalName:
description: Name of the property as it exists in an external application
type: string
externalNamespace:
description: Namespace from the external application
type: string
format:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeFormat'
description: Identifies the type of data represented by the string
items:
$ref: '#/components/schemas/UserSchemaAttributeItems'
master:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeMaster'
description: Identifies where the property is mastered
maxLength:
description: Maximum character length of a string property
nullable: true
type: integer
minLength:
description: Minimum character length of a string property
nullable: true
type: integer
mutability:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeMutabilityString'
description: Defines the mutability of the property
oneOf:
description: "Non-empty array of valid JSON schemas.\n\nOkta only supports\
\ `oneOf` for specifying display names for an `enum`. Each schema has\
\ the following format:\n\n ```\n {\n \"const\": \"enumValue\"\
,\n \"title\": \"display name\"\n }\n ```json\n\nWhen `enum`\
\ is used in conjunction with `oneOf`, you must keep the set of enumerated\
\ values and their order.\n\n ```\n {\"enum\": [\"S\",\"M\",\"L\"\
,\"XL\"],\n \"oneOf\": [\n {\"const\": \"S\", \"title\": \"\
Small\"},\n {\"const\": \"M\", \"title\": \"Medium\"},\n \
\ {\"const\": \"L\", \"title\": \"Large\"},\n {\"const\": \"XL\"\
, \"title\": \"Extra Large\"}\n ]\n }\n ```json\n\nThe `oneOf`\
\ key is only supported in conjunction with `enum` and provides a mechanism\
\ to return a display name for the `enum` value. "
items:
$ref: '#/components/schemas/UserSchemaAttributeEnum'
nullable: true
type: array
permissions:
description: Access control permissions for the property
items:
$ref: '#/components/schemas/UserSchemaAttributePermission'
nullable: true
type: array
required:
description: Determines whether the property is required
nullable: true
type: boolean
scope:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeScope'
description: Determines whether a group attribute can be set at the individual
or group level
title:
description: User-defined display name for the property
minLength: 1
type: string
type:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeType'
description: Type of property
unique:
type: string
type: object
GroupSchemaBase:
example:
id: id
type: type
properties: ""
required:
- required
- required
properties:
id:
description: The subschema name
readOnly: true
type: string
properties:
allOf:
- $ref: '#/components/schemas/GroupSchemaBaseProperties'
description: The `#base` object properties
required:
description: A collection indicating required property names
items:
type: string
readOnly: true
type: array
type:
description: The object type
readOnly: true
type: string
type: object
GroupSchemaBaseProperties:
description: "All Okta-defined Profile properties are defined in a Profile subschema\
\ with the resolution scope `#base`. These properties can't be removed or\
\ edited, regardless of any attempt to do so."
properties:
description:
allOf:
- $ref: '#/components/schemas/GroupSchemaAttribute'
description: Human readable description of the Group
name:
allOf:
- $ref: '#/components/schemas/GroupSchemaAttribute'
description: Unique identifier for the Group
type: object
GroupSchemaCustom:
description: All custom Profile properties are defined in a Profile subschema
with the resolution scope `#custom`
example:
id: id
type: type
properties:
key:
minLength: 6
externalNamespace: externalNamespace
format: ""
description: description
title: title
type: ""
enum:
- GroupSchemaAttribute_enum_inner
- GroupSchemaAttribute_enum_inner
required: true
master: ""
oneOf:
- const: const
title: title
- const: const
title: title
permissions:
- principal: principal
action: action
- principal: principal
action: action
externalName: externalName
scope: ""
unique: unique
mutability: ""
items:
oneOf:
- const: const
title: title
- const: const
title: title
type: type
enum:
- enum
- enum
maxLength: 0
required:
- required
- required
properties:
id:
description: The subschema name
readOnly: true
type: string
properties:
additionalProperties:
$ref: '#/components/schemas/GroupSchemaAttribute'
description: The `#custom` object properties
type: object
required:
description: A collection indicating required property names
items:
type: string
readOnly: true
type: array
type:
description: The object type
readOnly: true
type: string
type: object
GroupSchemaDefinitions:
example:
custom:
id: id
type: type
properties:
key:
minLength: 6
externalNamespace: externalNamespace
format: ""
description: description
title: title
type: ""
enum:
- GroupSchemaAttribute_enum_inner
- GroupSchemaAttribute_enum_inner
required: true
master: ""
oneOf:
- const: const
title: title
- const: const
title: title
permissions:
- principal: principal
action: action
- principal: principal
action: action
externalName: externalName
scope: ""
unique: unique
mutability: ""
items:
oneOf:
- const: const
title: title
- const: const
title: title
type: type
enum:
- enum
- enum
maxLength: 0
required:
- required
- required
base:
id: id
type: type
properties: ""
required:
- required
- required
properties:
base:
$ref: '#/components/schemas/GroupSchemaBase'
custom:
$ref: '#/components/schemas/GroupSchemaCustom'
type: object
GroupType:
description: Determines how a Group's Profile and memberships are managed
enum:
- APP_GROUP
- BUILT_IN
- OKTA_GROUP
type: string
x-enumDescriptions:
APP_GROUP: Group Profile and memberships are imported and must be managed
within the app (such as Active Directory or LDAP) that imported the Group
BUILT_IN: Group Profile and memberships are managed by Okta and can't be modified
OKTA_GROUP: Group Profile and memberships are directly managed in Okta via
static assignments or indirectly through Group rules
GroupsLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Application Groups](/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HelpLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the app help resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HookKey:
description: "The `id` property in the response as `id` serves as the unique\
\ ID for the key, which you can specify when invoking other CRUD operations.\
\ \n\nThe `keyId` provided in the response is the alias of the public key\
\ that you can use to get details of the public key data in a separate call."
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
created: 2000-01-23T04:56:07.000+00:00
name: name
keyId: keyId
id: id
isUsed: isUsed
properties:
created:
description: Timestamp when the key was created
format: date-time
nullable: true
readOnly: true
type: string
id:
description: The unique identifier for the key
nullable: false
readOnly: true
type: string
isUsed:
description: Whether this key is currently in use by other applications
format: boolean
nullable: false
readOnly: true
type: string
keyId:
description: The alias of the public key
nullable: false
readOnly: true
type: string
lastUpdated:
description: Timestamp when the key was updated
format: date-time
nullable: true
readOnly: true
type: string
name:
description: Display name of the key
maxLength: 255
minLength: 1
nullable: false
readOnly: false
type: string
title: HookKeyInstance
type: object
HostedPage:
example:
type: EXTERNALLY_HOSTED
url: url
properties:
type:
$ref: '#/components/schemas/HostedPageType'
url:
type: string
required:
- type
type: object
HostedPageType:
enum:
- EXTERNALLY_HOSTED
- OKTA_DEFAULT
type: string
HrefCsrPublishLink:
description: Link to publish CSR
example:
hints:
allow:
- POST
- POST
href: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish"
properties:
hints:
$ref: '#/components/schemas/CsrPublishHrefHints'
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50/lifecycle/publish"
type: string
readOnly: true
required:
- href
title: Link Object
type: object
HrefCsrSelfLink:
description: Link to the resource (self)
example:
hints:
allow:
- GET
- GET
href: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50"
properties:
hints:
$ref: '#/components/schemas/CsrSelfHrefHints'
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/apps/0oad5lTSBOMUBOBVVQSC/credentials/csrs/h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50"
type: string
readOnly: true
required:
- href
title: Link Object
type: object
HrefHints:
description: Describes allowed HTTP verbs for the `href`
example:
allow:
- DELETE
- DELETE
properties:
allow:
items:
$ref: '#/components/schemas/HttpMethod'
type: array
type: object
HrefHintsGuidanceObject:
allOf:
- $ref: '#/components/schemas/HrefHints'
- description: Describes allowed HTTP verbs and guidance for the `href`
- properties:
guidance:
description: |
Specifies the URI to invoke for granting scope consent required to complete the OAuth 2.0 connection
items:
type: string
type: array
type: object
example:
allow:
- DELETE
- DELETE
guidance:
- guidance
- guidance
HrefObject:
additionalProperties: true
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
hints:
$ref: '#/components/schemas/HrefHints'
href:
description: Link URI
type: string
name:
description: Link name
type: string
templated:
description: Indicates whether the Link Object's `href` property is a URI
template.
type: boolean
type:
description: "The media type of the link. If omitted, it is implicitly `application/json`."
type: string
readOnly: true
required:
- href
title: Link Object
type: object
HrefObjectActivateLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to activate the resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectAppLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the app resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectAssigneeLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the assignee resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectAuthorizeLink:
description: Link to authorize scopes
example:
hints:
allow:
- DELETE
- DELETE
guidance:
- guidance
- guidance
href: href
properties:
hints:
$ref: '#/components/schemas/HrefHintsGuidanceObject'
href:
description: Link URI
type: string
readOnly: true
required:
- href
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
HrefObjectClientLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the client resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectDeactivateLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to deactivate the resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectDeleteLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to delete the resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectGovernanceResourcesLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the resources
HrefObjectGrantAerialConsent:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to grant Okta Aerial access to your Org
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectGroupLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the group resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectLogoLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the logo resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectMappingsLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the mappings resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectMemberLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the member resource
HrefObjectPermissionsLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the permissions resource
HrefObjectResourceSetLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the resource-set resource
HrefObjectRetrieveAerialConsent:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to retrieve Okta Aerial consent for your Org
HrefObjectRevokeAerialConsent:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to revoke Okta Aerial consent for your Org
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectRoleLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the role resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectRulesLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the rules resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectSelfLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the resource (self)
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectSuspendLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to suspend the resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectUnsuspendLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to unsuspend the resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HrefObjectUserLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the user resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
HttpMethod:
enum:
- DELETE
- GET
- POST
- PUT
type: string
IAMBundleEntitlement:
properties:
resourceSets:
items:
type: string
type: array
role:
type: string
targets:
items:
type: string
type: array
type: object
IPNetworkZone:
allOf:
- $ref: '#/components/schemas/NetworkZone'
- title: IP Network Zone
- properties:
gateways:
description: |-
The IP addresses (range or CIDR form) for an IP Network Zone.
The maximum array length is 150 entries for admin-created IP zones, 1000 entries for IP blocklist zones, and 5000 entries for the default system IP Zone.
items:
$ref: '#/components/schemas/NetworkZoneAddress'
type: array
proxies:
description: |-
The IP addresses (range or CIDR form) that are allowed to forward a request from gateway addresses for an IP Network Zone.
These proxies are automatically trusted by Threat Insights and used to identify the client IP of a request.
The maximum array length is 150 entries for admin-created zones and 5000 entries for the default system IP Zone.
items:
$ref: '#/components/schemas/NetworkZoneAddress'
nullable: true
type: array
type: object
IPServiceCategory:
description: "An IP service offered by a provider, such as a proxy or VPN"
enum:
- ALL_ANONYMIZERS
- ALL_ANONYMIZERS_EXCEPT_TOR
- ALL_IP_SERVICES
- ALL_PROXIES_VPNS
- ANONYMIZER_TOR
- APPLE_ICLOUD_RELAY_PROXY
- AVAST_VPN
- GLOBALPROTECT_VPN
- GOOGLE_VPN
- MULLVAD_VPN
- NORD_VPN
- OXYLABS_PROXY
- SAMSUNG_VPN
- SURFSHARK_VPN
- SYMANTEC_VPN
- TRENDMICRO_VPN
- ULTRASURF_VPN
type: string
IamRole:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
permissions:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
description: description
id: id
label: label
properties:
created:
description: Timestamp when the role was created
format: date-time
readOnly: true
type: string
description:
description: Description of the role
type: string
id:
description: Unique key for the role
readOnly: true
type: string
label:
description: Unique label for the role
type: string
lastUpdated:
description: Timestamp when the role was last updated
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/IamRole__links'
required:
- description
- label
type: object
IamRoles:
example:
_links:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
roles:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
permissions:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
description: description
id: id
label: label
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
permissions:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
description: description
id: id
label: label
properties:
roles:
items:
$ref: '#/components/schemas/IamRole'
type: array
_links:
$ref: '#/components/schemas/LinksNext'
type: object
IdPCertificateCredential:
example:
x5c:
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
properties:
x5c:
description: Base64-encoded X.509 certificate chain with DER encoding
items:
example: MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
type: string
type: array
required:
- x5c
type: object
IdPCsr:
description: Defines a CSR for a signature or decryption credential for an IdP
example:
kty: RSA
csr: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
_links:
publish: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2016-01-03T18:15:47Z
id: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50
properties:
created:
description: Timestamp when the object was created
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
csr:
description: Base64-encoded CSR in DER format
example: MIIC4DCCAcgCAQAwcTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCk9rdGEsIEluYy4xDDAKBgNVBAsMA0RldjESMBAGA1UEAwwJU1AgSXNzdWVyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA6m8jHVCr9/tKvvbFN59T4raoCs/78KRm4fSefHQOv1TKLXo4wTLbsqYWRWc5u0sd5orUMQgPQOyj3i6qh13mALY4BzrT057EG1BUNjGg29QgYlnOk2iX890e5BIDMQQEIKFrvOi2V8cLUkLvE2ydRn0VO1Q1frbUkYeStJYC5Api2JQsYRwa+1ZeDH1ITnIzUaugWhW2WB2lSnwZkenne5KtffxMPYVu+IhNRHoKaRA6Z51YNhMJIx17JM2hs/H4Ka3drk6kzDf7ofk/yBpb9yBWyU7CTSQhdoHidxqFprMDaT66W928t3AeOENHBuwn8c2K9WeGG+bELNyQRJVmawIDAQABoCowKAYJKoZIhvcNAQkOMRswGTAXBgNVHREEEDAOggxkZXYub2t0YS5jb20wDQYJKoZIhvcNAQELBQADggEBAA2hsVJRVM+A83X9MekjTnIbt19UNT8wX7wlE9jUKirWsxceLiZBpVGn9qfKhhVIpvdaIRSeoFYS2Kg/m1G6bCvjmZLcrQ5FcEBjZH2NKfNppGVnfC2ugtUkBtCB+UUzOhKhRKJtGugenKbP33zRWWIqnd2waF6Cy8TIuqQVPbwEDN9bCbAs7ND6CFYNguY7KYjWzQOeAR716eqpEEXuPYAS4nx/ty4ylonR8cv+gpq51rvq80A4k/36aoeM0Y6I4w64vhTfuvWW2UYFUD+/+y2FA2CSP4JfctySrf1s525v6fzTFZ3qZbB5OZQtP2b8xYWktMzywsxGKDoVDB4wkH4=
readOnly: true
type: string
id:
description: Unique identifier for the CSR
example: h9zkutaSe7fZX0SwN1GqDApofgD1OW8g2B5l2azha50
readOnly: true
type: string
kty:
description: Cryptographic algorithm family for the CSR's keypair
example: RSA
type: string
_links:
$ref: '#/components/schemas/IdPCsr__links'
type: object
IdPCsrPkcs10:
description: Base64URL-encoded CSR in DER format
format: base64
type: string
IdPKeyCredential:
additionalProperties: true
description: "A [JSON Web Key](https://tools.ietf.org/html/rfc7517) for a signature\
\ or encryption credential for an IdP"
example:
kty: RSA
lastUpdated: 2016-01-03T18:15:47Z
x5t#S256: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE
e: AQAB
created: 2016-01-03T18:15:47Z
use: sig
kid: your-key-id
x5c:
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
- MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
expiresAt: 2016-01-03T18:15:47Z
"n": "101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747"
properties:
created:
description: Timestamp when the object was created
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
e:
description: The exponent value for the RSA public key
example: AQAB
type: string
expiresAt:
description: Timestamp when the object expires
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
kid:
description: Unique identifier for the key
example: your-key-id
type: string
kty:
description: "Identifies the cryptographic algorithm family used with the\
\ key (Supported value: `RSA`)"
example: RSA
type: string
lastUpdated:
description: Timestamp when the object was last updated
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
"n":
description: The modulus value for the RSA public key
example: "101438407598598116085679865987760095721749307901605456708912786847324207000576780508113360584555007890315805735307890113536927352312915634368993759211767770602174860126854831344273970871509573365292777620005537635317282520456901584213746937262823585533063042033441296629204165064680610660631365266976782082747"
type: string
use:
description: "Intended use of the public key (Supported value: `sig`)"
example: sig
type: string
x5c:
description: Base64-encoded X.509 certificate chain with DER encoding
items:
example: MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
type: string
type: array
x5t#S256:
description: Base64url-encoded SHA-256 thumbprint of the DER encoding of
an X.509 certificate
example: wzPVobIrveR1x-PCbjsFGNV-6zn7Rm9KuOWOG4Rk6jE
type: string
type: object
IdentityProvider:
example:
lastUpdated: 2016-01-03T18:15:47Z
protocol:
algorithms:
request:
signature:
scope: ANY
algorithm: algorithm
response:
signature:
scope: ANY
algorithm: algorithm
relayState:
format: FROM_URL
settings:
nameFormat: nameFormat
endpoints:
acs:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
authorization:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
userInfo:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
metadata:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
jwks:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
slo:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
sso:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
token:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
credentials:
trust:
revocation: CRL
audience: audience
revocationCacheLifetime: 0
kid: kid
issuer: issuer
client:
pkce_required: true
client_secret: client_secret
client_id: client_id
signing:
kid: kid
scopes:
- scopes
- scopes
type: MTLS
issuer:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
_links:
acs: ""
metadata: ""
keys: ""
activate: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
clientRedirectUri: ""
authorize: ""
users: ""
deactivate: ""
created: 2016-01-03T18:15:47Z
name: Sample Identity Provider
id: 0oaWma58liwx40w6boYD
type: AMAZON
issuerMode: DYNAMIC
properties:
additionalAmr:
- sc
- sc
ialValue: ialValue
aalValue: aalValue
policy:
subject:
filter: (\S+@example\.com)
matchAttribute: login
matchType: CUSTOM_ATTRIBUTE
userNameTemplate:
template: idpuser.subjectNameId
maxClockSkew: 120000
provisioning:
action: AUTO
groups:
filter:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
assignments:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
sourceAttributeName: Groups
action: APPEND
profileMaster: true
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter:
groups:
include:
- 00gjg5lzfBpn62wuF0g3
- 00gjg5lzfBpn62wuF0g3
action: AUTO
status: ACTIVE
properties:
created:
description: Timestamp when the object was created
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
id:
description: Unique key for the IdP
example: 0oaWma58liwx40w6boYD
readOnly: true
type: string
issuerMode:
$ref: '#/components/schemas/IdentityProviderIssuerMode'
lastUpdated:
description: Timestamp when the object was last updated
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
name:
description: Unique name for the IdP
example: Sample Identity Provider
maxLength: 100
type: string
policy:
$ref: '#/components/schemas/IdentityProviderPolicy'
properties:
$ref: '#/components/schemas/IdentityProviderProperties'
protocol:
$ref: '#/components/schemas/Protocol'
status:
$ref: '#/components/schemas/LifecycleStatus'
type:
$ref: '#/components/schemas/IdentityProviderType'
_links:
$ref: '#/components/schemas/IdentityProvider__links'
type: object
IdentityProviderApplicationUser:
example:
lastUpdated: 2016-01-03T18:15:47Z
_embedded:
key: "{}"
_links:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
idp:
href: "https://{yourOktaDomain}/api/v1/idps/0oa1k5d68qR2954hb0g4"
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
href: "https://{yourOktaDomain}/api/v1/users/00ulwodIu7wCfdiVR0g3"
created: 2016-01-03T18:15:47Z
profile:
lastName: Jackson
subjectNameQualifier: example.com
subjectSpNameQualifier: urn:federation:example
authnContextClassRef: null
subjectNameId: saml.jackson@example.com
subjectConfirmationAddress: null
displayName: Saml Jackson
mobilePhone: +1-415-555-5141
email: saml.jackson@example.com
subjectNameFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
firstName: Saml
subjectSpProvidedId: null
subjectConfirmationMethod: null
externalId: saml.jackson@example.com
id: id
properties:
created:
description: Timestamp when the object was created
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
externalId:
description: Unique IdP-specific identifier for the User
example: saml.jackson@example.com
maxLength: 512
readOnly: true
type: string
id:
description: Unique key of the User
readOnly: true
type: string
lastUpdated:
description: Timestamp when the object was last updated
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
profile:
additionalProperties:
properties: {}
type: object
description: "IdP-specific profile for the User. \n\nIdentity Provider User\
\ profiles are IdP-specific but may be customized by the Profile Editor\
\ in the Admin Console.\n\n> **Note:** Okta variable names have reserved\
\ characters that may conflict with the name of an IdP assertion attribute.\
\ You can use the **External name** to define the attribute name as defined\
\ in an IdP assertion such as a SAML attribute name."
example:
lastName: Jackson
subjectNameQualifier: example.com
subjectSpNameQualifier: urn:federation:example
authnContextClassRef: null
subjectNameId: saml.jackson@example.com
subjectConfirmationAddress: null
displayName: Saml Jackson
mobilePhone: +1-415-555-5141
email: saml.jackson@example.com
subjectNameFormat: urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
firstName: Saml
subjectSpProvidedId: null
subjectConfirmationMethod: null
type: object
_embedded:
additionalProperties:
properties: {}
type: object
description: Embedded resources related to the IdP User
readOnly: true
type: object
_links:
$ref: '#/components/schemas/IdentityProviderApplicationUser__links'
type: object
IdentityProviderCredentials:
example:
trust:
revocation: CRL
audience: audience
revocationCacheLifetime: 0
kid: kid
issuer: issuer
client:
pkce_required: true
client_secret: client_secret
client_id: client_id
signing:
kid: kid
properties:
client:
$ref: '#/components/schemas/IdentityProviderCredentialsClient'
signing:
$ref: '#/components/schemas/IdentityProviderCredentialsSigning'
trust:
$ref: '#/components/schemas/IdentityProviderCredentialsTrust'
type: object
IdentityProviderCredentialsClient:
example:
pkce_required: true
client_secret: client_secret
client_id: client_id
properties:
client_id:
type: string
client_secret:
type: string
pkce_required:
description: Require Proof Key for Code Exchange (PKCE) for additional verification
type: boolean
type: object
IdentityProviderCredentialsSigning:
example:
kid: kid
properties:
kid:
type: string
type: object
IdentityProviderCredentialsTrust:
example:
revocation: CRL
audience: audience
revocationCacheLifetime: 0
kid: kid
issuer: issuer
properties:
audience:
type: string
issuer:
type: string
kid:
type: string
revocation:
$ref: '#/components/schemas/IdentityProviderCredentialsTrustRevocation'
revocationCacheLifetime:
type: integer
type: object
IdentityProviderCredentialsTrustRevocation:
enum:
- CRL
- DELTA_CRL
- OCSP
type: string
IdentityProviderIssuerMode:
default: DYNAMIC
description: Indicates whether Okta uses the original Okta org domain URL or
a custom domain URL in the request to the social IdP
enum:
- CUSTOM_URL
- DYNAMIC
- ORG_URL
type: string
x-enumDescriptions:
ORG_URL: "In the authorize request to the social IdP, Okta uses the Okta org's\
\ original domain URL (`https://${yourOktaDomain}`) as the domain in the\
\ `redirect_uri`."
CUSTOM_URL: "In the authorize request to the social IdP, Okta uses the custom\
\ domain URL as the domain in the `redirect_uri`. You can set `issuerMode`\
\ to `CUSTOM_URL` only if you have a custom URL domain configured."
DYNAMIC: "In the authorize request to the social IdP, Okta uses the custom\
\ domain URL as the domain in the `redirect_uri` if the request was made\
\ from the custom domain URL. Otherwise, Okta uses the Okta org's original\
\ domain URL if the request was made from the Okta org domain."
IdentityProviderPolicy:
allOf:
- properties:
accountLink:
$ref: '#/components/schemas/PolicyAccountLink'
maxClockSkew:
description: Maximum allowable clock skew when processing messages from
the IdP
example: 120000
type: integer
provisioning:
$ref: '#/components/schemas/Provisioning'
subject:
$ref: '#/components/schemas/PolicySubject'
type: object
description: "Policy settings for the IdP. \nThe following provisioning and\
\ account linking actions are supported by each IdP provider:\n| IdP type\
\ | User provisioning\
\ actions | Group provisioning actions | Account link actions |\
\ Account link filters |\n| -----------------------------------------------------------------\
\ | ------------------------- | ------------------------------------- | --------------------\
\ | -------------------- |\n| `SAML2` \
\ | `AUTO` or `DISABLED` | `NONE`, `ASSIGN`, `APPEND`,\
\ or `SYNC` | `AUTO`, `DISABLED` | `groups` |\n| `X509` \
\ | `DISABLED` \
\ | No support for JIT provisioning | \
\ | |\n| All social IdP types (any IdP type that isn't\
\ `SAML2` or `X509`) | `AUTO`, `DISABLED` | `NONE` or `ASSIGN` \
\ | `AUTO`, `DISABLED` | `groups` |"
example:
subject:
filter: (\S+@example\.com)
matchAttribute: login
matchType: CUSTOM_ATTRIBUTE
userNameTemplate:
template: idpuser.subjectNameId
maxClockSkew: 120000
provisioning:
action: AUTO
groups:
filter:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
assignments:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
sourceAttributeName: Groups
action: APPEND
profileMaster: true
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
accountLink:
filter:
groups:
include:
- 00gjg5lzfBpn62wuF0g3
- 00gjg5lzfBpn62wuF0g3
action: AUTO
IdentityProviderPolicyProvider:
enum:
- ANY
- OKTA
- SPECIFIC_IDP
type: string
IdentityProviderPolicyRuleCondition:
properties:
idpIds:
items:
type: string
type: array
provider:
$ref: '#/components/schemas/IdentityProviderPolicyProvider'
type: object
IdentityProviderProperties:
description: The properties in the Identity Provider Properties object vary
depending on the IdP type
example:
additionalAmr:
- sc
- sc
ialValue: ialValue
aalValue: aalValue
nullable: true
properties:
aalValue:
description: "The [authentication assurance level](https://developers.login.gov/oidc/#aal-values)\
\ (AAL) value for the Login.gov IdP. \nSee [Add a Login.gov IdP](https://developer.okta.com/docs/guides/add-logingov-idp/).\
\ Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types."
nullable: true
type: string
additionalAmr:
description: The additional Assurance Methods References (AMR) values for
Smart Card IdPs. Applies to `X509` IdP type.
items:
enum:
- sc
- hwk
- pin
- mfa
type: string
x-enumDescriptions:
sc: Smart card
hwk: Hardware-secured key
pin: Personal identification number
mfa: Multifactor authentication
nullable: true
type: array
ialValue:
description: "The [type of identity verification](https://developers.login.gov/oidc/#ial-values)\
\ (IAL) value for the Login.gov IdP. \nSee [Add a Login.gov IdP](https://developer.okta.com/docs/guides/add-logingov-idp/).\
\ Applies to `LOGINGOV` and `LOGINGOV_SANDBOX` IdP types."
nullable: true
type: string
type: object
IdentityProviderType:
description: "The Identity Provider object's `type` property identifies the\
\ social or enterprise Identity Provider used for authentication. \nEach Identity\
\ Provider uses a specific protocol, therefore the `protocol` property must\
\ correspond with the IdP `type`. \nIf the protocol is OAuth 2.0-based, the\
\ Protocol object's `scopes` property must also correspond with the scopes\
\ supported by the IdP `type`. \nFor policy actions supported by each IdP\
\ type, see [IdP type policy actions](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy&t=request).\n\
\n| Type | Description \
\ \
\ | Corresponding protocol | Corresponding protocol\
\ scopes |\n| ------------------ |\
\ -----------------------------------------------------------------------------------------------------------------------------------------------------\
\ | ---------------------- | --------------------------------------------------------------------\
\ |\n| `AMAZON` | [Amazon](https://developer.amazon.com/settings/console/registration?return_to=/) as\
\ the Identity Provider | OpenID Connect\
\ | `profile`, `profile:user_id` \
\ |\n| `APPLE` | [Apple](https://developer.apple.com/sign-in-with-apple/) as\
\ the Identity Provider \
\ | OpenID Connect | `names`, `email`, `openid` \
\ |\n| `DISCORD` | [Discord](https://discord.com/login) as\
\ the Identity Provider \
\ | OAuth 2.0 | `identify`,\
\ `email` |\n| `FACEBOOK`\
\ | [Facebook](https://developers.facebook.com) as the Identity\
\ Provider \
\ | OAuth 2.0 | `public_profile`, `email` \
\ |\n| `GITHUB` | [GitHub](https://github.com/join) as\
\ the Identity Provider \
\ | OAuth 2.0 | `user` \
\ |\n| `GITLAB`\
\ | [GitLab](https://gitlab.com/users/sign_in) as the Identity\
\ Provider \
\ | OpenID Connect | `openid`, `read_user`, `profile`,\
\ `email` |\n| `GOOGLE` | [Google](https://accounts.google.com/signup) as\
\ the Identity Provider \
\ | OpenID Connect | `openid`, `email`, `profile`\
\ |\n| `LINKEDIN` | [LinkedIn](https://developer.linkedin.com/) as\
\ the Identity Provider \
\ | OAuth 2.0 | `r_emailaddress`, `r_liteprofile`\
\ |\n| `LOGINGOV` | [Login.gov](https://developers.login.gov/) as\
\ the Identity Provider \
\ | OpenID Connect | `email`, `profile`,\
\ `profile:name` |\n| `LOGINGOV_SANDBOX`\
\ | [Login.gov's identity sandbox](https://developers.login.gov/testing/) as\
\ the Identity Provider \
\ | OpenID Connect | `email`, `profile`, `profile:name` \
\ |\n| `MICROSOFT` | [Microsoft Enterprise\
\ SSO](https://azure.microsoft.com/) as the Identity Provider \
\ | OpenID Connect\
\ | `openid`, `email`, `profile`, `https://graph.microsoft.com/User.Read`\
\ |\n| `OIDC` | IdP provider that supports [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html)\
\ | OpenID Connect \
\ | `openid`, `email`, `profile` \
\ |\n| `PAYPAL` | [Paypal](https://www.paypal.com/signin) as\
\ the Identity Provider \
\ | OpenID Connect | `openid`, `email`,\
\ `profile` |\n| `PAYPAL_SANDBOX`\
\ | [Paypal Sandbox](https://developer.paypal.com/tools/sandbox/) as\
\ the Identity Provider \
\ | OpenID Connect | `openid`, `email`, `profile` \
\ |\n| `SALESFORCE` | [SalesForce](https://login.salesforce.com/) as\
\ the Identity Provider \
\ | OAuth 2.0 | `id`, `email`, `profile`\
\ |\n| `SAML2` | Enterprise\
\ IdP provider that supports the [SAML 2.0 Web Browser SSO Profile](https://docs.oasis-open.org/security/saml/v2.0/saml-profiles-2.0-os.pdf)\
\ | SAML 2.0 | \
\ |\n| `SPOTIFY` | [Spotify](https://developer.spotify.com/) as\
\ the Identity Provider \
\ | OpenID Connect | `user-read-email`,\
\ `user-read-private` |\n| `X509` \
\ | [Smart Card IdP](https://tools.ietf.org/html/rfc5280) \
\ \
\ | Mutual TLS | \
\ |\n| `XERO` | [Xero](https://www.xero.com/us/signup/api/) as\
\ the Identity Provider \
\ | OpenID Connect | `openid`, `profile`,\
\ `email` |\n| `YAHOO` \
\ | [Yahoo](https://login.yahoo.com/) as the Identity Provider \
\ \
\ | OpenID Connect | `openid`, `profile`, `email` \
\ |\n| `YAHOOJP` | [Yahoo Japan](https://login.yahoo.co.jp/config/login) as\
\ the Identity Provider \
\ | OpenID Connect | `openid`, `profile`, `email`\
\ |"
enum:
- AMAZON
- APPLE
- DISCORD
- FACEBOOK
- GITHUB
- GITLAB
- GOOGLE
- LINKEDIN
- LOGINGOV
- LOGINGOV_SANDBOX
- MICROSOFT
- OIDC
- PAYPAL
- PAYPAL_SANDBOX
- SALESFORCE
- SAML2
- SPOTIFY
- X509
- XERO
- YAHOO
- YAHOOJP
type: string
IdentitySourceSession:
example:
identitySourceId: identitySourceId
lastUpdated: 2000-01-23T04:56:07.000+00:00
importType: importType
created: 2000-01-23T04:56:07.000+00:00
id: id
status: CLOSED
properties:
created:
description: The timestamp when the Identity Source Session was created
format: date-time
readOnly: true
type: string
id:
description: The ID of the Identity Source Session
readOnly: true
type: string
identitySourceId:
description: The ID of the custom Identity Source for which the session
is created
readOnly: true
type: string
importType:
description: The type of import. All imports are `INCREMENTAL` imports.
readOnly: true
type: string
lastUpdated:
description: The timestamp when the Identity Source Session was created
format: date-time
readOnly: true
type: string
status:
$ref: '#/components/schemas/IdentitySourceSessionStatus'
type: object
IdentitySourceSessionStatus:
enum:
- CLOSED
- COMPLETED
- CREATED
- ERROR
- EXPIRED
- IN_PROGRESS
- TRIGGERED
type: string
x-enumDescriptions:
CREATED: This is a new Identity Source Session that hasn't been processed.
You can upload bulk data in this stage.
IN_PROGRESS: The bulk data is being uploaded to Okta.
TRIGGERED: Okta is processing the import data in this session. You can't load
bulk data in this stage.
COMPLETED: The bulk data was processed and imported into Okta.
CLOSED: The Identity Source Session was canceled and isn't available for further
activity.
EXPIRED: This Identity Source Session had the `CREATED` status and timed-out
after 24 hours of inactivity.
ERROR: The processing of import data in the session encountered an error.
You need to open a new session to upload the data again.
IdentitySourceUserProfileForDelete:
example:
externalId: externalId
properties:
externalId:
description: The external ID of the entity that needs to be deleted in Okta
maxLength: 512
type: string
type: object
IdentitySourceUserProfileForUpsert:
example:
firstName: firstName
lastName: lastName
mobilePhone: mobilePhone
secondEmail: secondEmail
userName: userName
email: email
homeAddress: homeAddress
properties:
email:
description: Email address of the user
format: email
maxLength: 100
minLength: 5
type: string
firstName:
description: First name of the user
maxLength: 50
minLength: 1
nullable: true
type: string
homeAddress:
description: Home address of the user
maxLength: 4096
nullable: true
type: string
lastName:
description: Last name of the user
maxLength: 50
minLength: 1
nullable: true
type: string
mobilePhone:
description: Mobile phone number of the user
maxLength: 100
nullable: true
type: string
secondEmail:
description: Alternative email address of the user
format: email
maxLength: 100
minLength: 5
type: string
userName:
description: Username of the user
maxLength: 100
type: string
type: object
IdpDiscoveryPolicy:
allOf:
- $ref: '#/components/schemas/Policy'
- properties:
conditions:
description: Policy conditions aren't supported for this policy type.
nullable: true
type: string
type: object
IdpDiscoveryPolicyRule:
allOf:
- $ref: '#/components/schemas/PolicyRule'
- properties:
actions:
$ref: '#/components/schemas/IdpPolicyRuleAction'
conditions:
$ref: '#/components/schemas/IdpDiscoveryPolicyRuleCondition'
type: object
IdpDiscoveryPolicyRuleCondition:
allOf:
- properties:
app:
$ref: '#/components/schemas/AppAndInstancePolicyRuleCondition'
network:
$ref: '#/components/schemas/PolicyNetworkCondition'
userIdentifier:
$ref: '#/components/schemas/UserIdentifierPolicyRuleCondition'
platform:
$ref: '#/components/schemas/PlatformPolicyRuleCondition'
type: object
IdpPolicyRuleAction:
properties:
idp:
$ref: '#/components/schemas/IdpPolicyRuleAction_idp'
type: object
IdpPolicyRuleActionMatchCriteria:
properties:
propertyName:
description: The IdP property that the evaluated string should match to
type: string
providerExpression:
description: |
You can provide an Okta Expression Language expression with the Login Context that's evaluated with the IdP. For example, the value `login.identifier` refers to the user's username. If the user is signing in with the username `john.doe@mycompany.com`, the expression `login.identifier.substringAfter(@))` is evaluated to the domain name of the user, for example: `mycompany.com`.
type: string
type: object
IdpPolicyRuleActionProvider:
properties:
id:
description: "IdP types of `OKTA`, `AgentlessDSSO`, and `IWA` don't require\
\ an ID."
type: string
name:
description: Provider `name` in Okta. Optional. Supported in `IDENTITY ENGINE`.
type: string
type:
$ref: '#/components/schemas/IdentityProviderType'
type: object
IdpSelectionType:
description: Determines whether the rule should use expression language or a
specific IdP
enum:
- DYNAMIC
- SPECIFIC
type: string
IframeEmbedScopeAllowedApps:
enum:
- OKTA_ENDUSER
type: string
ImageUploadResponse:
example:
url: url
properties:
url:
readOnly: true
type: string
type: object
ImportScheduleObject:
description: Import schedule configuration
properties:
fullImport:
$ref: '#/components/schemas/ImportScheduleObject_fullImport'
incrementalImport:
$ref: '#/components/schemas/ImportScheduleObject_incrementalImport'
status:
$ref: '#/components/schemas/EnabledStatus'
type: object
ImportScheduleSettings:
properties:
expression:
description: The import schedule in UNIX cron format
example: "00 21 * * Mon,Thu,Fri,Sat"
type: string
timezone:
description: The import schedule time zone in Internet Assigned Numbers
Authority (IANA) time zone name format
example: America/Los_Angeles
maxLength: 64
minLength: 1
type: string
required:
- expression
type: object
ImportUsernameObject:
description: Determines the Okta username for the imported user
properties:
userNameExpression:
description: "For `usernameFormat=CUSTOM`, specifies the Okta Expression\
\ Language statement for a username format that imported users use to\
\ sign in to Okta"
type: string
usernameFormat:
default: EMAIL
description: Determines the username format when users sign in to Okta
enum:
- EMAIL
- CUSTOM
type: string
required:
- usernameFormat
type: object
InactivityPolicyRuleCondition:
properties:
number:
type: integer
unit:
type: string
type: object
InboundProvisioningApplicationFeature:
allOf:
- $ref: '#/components/schemas/ApplicationFeature'
- type: object
- properties:
capabilities:
$ref: '#/components/schemas/CapabilitiesInboundProvisioningObject'
InlineHook:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
metadata:
key: metadata
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
channel:
type: HTTP
version: version
name: name
id: id
type: com.okta.import.transform
version: version
status: ACTIVE
properties:
channel:
$ref: '#/components/schemas/InlineHookChannel'
created:
format: date-time
readOnly: true
type: string
id:
readOnly: true
type: string
lastUpdated:
format: date-time
readOnly: true
type: string
metadata:
additionalProperties:
type: string
description: "Specific properties for the inline hook configuration, for\
\ example, `optOutServiceProtectionRateLimit` to opt-out of Telephony\
\ Service Protection Rate Limits when using the Telephony inline hook."
type: object
name:
type: string
status:
$ref: '#/components/schemas/InlineHookStatus'
type:
$ref: '#/components/schemas/InlineHookType'
version:
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
InlineHookBasePayload:
properties:
cloudEventVersion:
description: The inline hook cloud version
example: "0.1"
type: string
contentType:
description: The inline hook request header content
example: application/JSON
type: string
eventId:
description: The individual inline hook request ID
example: 3o9jBzq1SmOGmmsDsqyyeQ
type: string
eventTime:
description: The time the inline hook request was sent
example: 2020-01-17T21:23:56.000Z
type: string
eventTypeVersion:
description: The inline hook version
example: "1"
type: string
type: object
InlineHookChannel:
discriminator:
mapping:
HTTP: '#/components/schemas/InlineHookChannelHttp'
OAUTH: '#/components/schemas/InlineHookChannelOAuth'
propertyName: type
example:
type: HTTP
version: version
properties:
type:
$ref: '#/components/schemas/InlineHookChannelType'
version:
type: string
type: object
InlineHookChannelConfig:
properties:
authScheme:
$ref: '#/components/schemas/InlineHookChannelConfigAuthScheme'
headers:
items:
$ref: '#/components/schemas/InlineHookChannelConfigHeaders'
type: array
method:
type: string
uri:
type: string
type: object
InlineHookChannelConfigAuthScheme:
properties:
key:
type: string
type:
type: string
value:
type: string
type: object
InlineHookChannelConfigHeaders:
properties:
key:
type: string
value:
type: string
type: object
InlineHookChannelHttp:
allOf:
- $ref: '#/components/schemas/InlineHookChannel'
- properties:
config:
$ref: '#/components/schemas/InlineHookChannelConfig'
type: object
InlineHookChannelOAuth:
allOf:
- $ref: '#/components/schemas/InlineHookChannel'
- properties:
config:
$ref: '#/components/schemas/InlineHookOAuthChannelConfig'
type: object
InlineHookChannelType:
enum:
- HTTP
- OAUTH
type: string
InlineHookOAuthBasicConfig:
allOf:
- $ref: '#/components/schemas/InlineHookChannelConfig'
properties:
authType:
type: string
clientId:
type: string
scope:
type: string
tokenUrl:
type: string
type: object
InlineHookOAuthChannelConfig:
discriminator:
mapping:
client_secret_post: '#/components/schemas/InlineHookOAuthClientSecretConfig'
private_key_jwt: '#/components/schemas/InlineHookOAuthPrivateKeyJwtConfig'
propertyName: authType
properties:
authType:
type: string
type: object
InlineHookOAuthClientSecretConfig:
allOf:
- $ref: '#/components/schemas/InlineHookOAuthBasicConfig'
properties:
clientSecret:
type: string
type: object
InlineHookOAuthPrivateKeyJwtConfig:
allOf:
- $ref: '#/components/schemas/InlineHookOAuthBasicConfig'
properties:
hookKeyId:
type: string
type: object
InlineHookPayload:
type: object
x-okta-extensible: true
InlineHookRequestObject:
description: The API request that triggered the inline hook
properties:
id:
description: The unique identifier that Okta assigned to the API request
type: string
ipAddress:
description: The IP address of the client that made the API request
type: string
method:
description: The HTTP request method of the API request
type: string
url:
$ref: '#/components/schemas/InlineHookRequestObject_url'
type: object
InlineHookResponse:
example:
commands:
- type: type
value:
- op: op
path: path
value: value
- op: op
path: path
value: value
- type: type
value:
- op: op
path: path
value: value
- op: op
path: path
value: value
properties:
commands:
items:
$ref: '#/components/schemas/InlineHookResponseCommands'
type: array
type: object
InlineHookResponseCommandValue:
example:
op: op
path: path
value: value
properties:
op:
type: string
path:
type: string
value:
type: string
type: object
InlineHookResponseCommands:
example:
type: type
value:
- op: op
path: path
value: value
- op: op
path: path
value: value
properties:
type:
type: string
value:
items:
$ref: '#/components/schemas/InlineHookResponseCommandValue'
type: array
type: object
InlineHookStatus:
enum:
- ACTIVE
- INACTIVE
type: string
InlineHookType:
enum:
- com.okta.import.transform
- com.okta.oauth2.tokens.transform
- com.okta.saml.tokens.transform
- com.okta.telephony.provider
- com.okta.user.credential.password.import
- com.okta.user.pre-registration
type: string
IssuerMode:
enum:
- CUSTOM_URL
- DYNAMIC
- ORG_URL
type: string
JsonPatchOperation:
description: The update action
example:
op: remove
path: path
value: "{}"
properties:
op:
$ref: '#/components/schemas/PatchAction'
path:
description: The resource path of the attribute to update
type: string
value:
description: The update operation value
type: object
type: object
JsonWebKey:
example:
kty: kty
lastUpdated: 2000-01-23T04:56:07.000+00:00
x5t#S256: x5t#S256
e: e
created: 2017-03-28T01:11:10Z
use: use
kid: kid
x5c:
- x5c
- x5c
expiresAt: 2000-01-23T04:56:07.000+00:00
"n": "n"
properties:
created:
description: Timestamp when the object was created
example: 2017-03-28T01:11:10Z
format: date-time
readOnly: true
type: string
e:
description: RSA key value (public exponent) for Key binding
readOnly: true
type: string
expiresAt:
description: Timestamp when the certificate expires
format: date-time
readOnly: true
type: string
kid:
description: Unique identifier for the certificate
readOnly: true
type: string
kty:
description: "Cryptographic algorithm family for the certificate's keypair.\
\ Valid value: `RSA`"
readOnly: true
type: string
lastUpdated:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
"n":
description: RSA modulus value that is used by both the public and private
keys and provides a link between them
type: string
use:
description: "Acceptable use of the certificate. Valid value: `sig`"
readOnly: true
type: string
x5c:
description: X.509 certificate chain that contains a chain of one or more
certificates
items:
type: string
readOnly: true
type: array
x5t#S256:
description: "X.509 certificate SHA-256 thumbprint, which is the base64url-encoded\
\ SHA-256 thumbprint (digest) of the DER encoding of an X.509 certificate"
readOnly: true
type: string
type: object
JwkUse:
example:
use: sig
properties:
use:
$ref: '#/components/schemas/JwkUseType'
type: object
JwkUseType:
description: Purpose of the certificate. The only supported value is `sig`.
enum:
- sig
type: string
KeepCurrent:
example:
keepCurrent: true
properties:
keepCurrent:
default: true
description: Skip deleting the user's current session when set to `true`
type: boolean
type: object
KeepMeSignedIn:
properties:
postAuth:
description: Whether the post-authentication Keep Me Signed In flow is allowed
enum:
- ALLOWED
- NOT_ALLOWED
type: string
postAuthPromptFrequency:
description: "A time duration specified as an [ISO-8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations)."
pattern: ^P(?:$)(\d+Y)?(\d+M)?(\d+W)?(\d+D)?(T(?:\d)(\d+H)?(\d+M)?(\d+S)?)?$
type: string
type: object
KeyRequest:
example:
name: name
properties:
name:
description: Display name for the key
maxLength: 255
minLength: 1
nullable: false
readOnly: false
type: string
uniqueItems: true
type: object
KeyTrustLevelBrowserKey:
description: Represents the attestation strength used by the Chrome Verified
Access API
enum:
- CHROME_BROWSER_HW_KEY
- CHROME_BROWSER_OS_KEY
example: CHROME_BROWSER_HW_KEY
type: string
x-enumDescriptions:
CHROME_BROWSER_HW_KEY: Identity of the device was attested using a key pair
that is OS encapsulated by a hardware layer
CHROME_BROWSER_OS_KEY: Identity of the device was attested using a key pair
that is simply stored on the device but not in any specific hardware layer
KeyTrustLevelOSMode:
description: Represents the attestation strength used by the Chrome Verified
Access API
enum:
- CHROME_OS_DEVELOPER_MODE
- CHROME_OS_VERIFIED_MODE
example: CHROME_OS_VERIFIED_MODE
type: string
x-enumDescriptions:
CHROME_OS_VERIFIED_MODE: "Identity of the device was attested using an enterprise-emitted\
\ certificate, and the device is in Verified mode"
CHROME_OS_DEVELOPER_MODE: "Identity of the device was attested using an enterprise-emitted\
\ certificate, and the device is in Developer mode"
KnowledgeConstraint:
allOf:
- $ref: '#/components/schemas/AccessPolicyConstraint'
Language:
description: "The language specified as an [IETF BCP 47 language tag](https://datatracker.ietf.org/doc/html/rfc5646)"
type: string
LastUpdated:
description: Timestamp when the object was last updated
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
LifecycleCreateSettingObject:
description: Determines whether to update a user in the app when a user in Okta
is updated
properties:
status:
allOf:
- $ref: '#/components/schemas/EnabledStatus'
- default: DISABLED
type: object
LifecycleDeactivateSettingObject:
description: Determines whether deprovisioning occurs when the app is unassigned
properties:
status:
allOf:
- $ref: '#/components/schemas/EnabledStatus'
- default: DISABLED
type: object
LifecycleExpirationPolicyRuleCondition:
properties:
lifecycleStatus:
type: string
number:
type: integer
unit:
type: string
type: object
LifecycleStatus:
enum:
- ACTIVE
- INACTIVE
type: string
LinkedHrefObject:
additionalProperties: true
example:
href: href
properties:
href:
description: Link URI
type: string
readOnly: true
required:
- href
title: Link Object
type: object
LinkedObject:
example:
_links:
self:
href: href
associated:
name: name
description: description
title: title
type: USER
primary:
name: name
description: description
title: title
type: USER
properties:
associated:
$ref: '#/components/schemas/LinkedObjectDetails'
primary:
$ref: '#/components/schemas/LinkedObjectDetails'
_links:
$ref: '#/components/schemas/LinkedObjectLinksSelf'
title: LinkedObject
type: object
LinkedObjectDetails:
example:
name: name
description: description
title: title
type: USER
properties:
description:
description: Description of the `primary` or the `associated` relationship
type: string
name:
description: "API name of the `primary` or the `associated` link. The `name`\
\ parameter can't start with a number and can only contain the following\
\ characters: `a-z`, `A-Z`,` 0-9`, and `_`."
type: string
title:
description: Display name of the `primary` or the `associated` link
type: string
type:
$ref: '#/components/schemas/LinkedObjectDetailsType'
required:
- name
- title
- type
title: LinkedObjectDetails
type: object
LinkedObjectDetailsType:
description: The object type for this relationship
enum:
- USER
type: string
x-enumDescriptions:
USER: Specifies the type of object
LinkedObjectLinksSelf:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of an application using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources\
\ and lifecycle operations."
example:
self:
href: href
properties:
self:
$ref: '#/components/schemas/LinkedHrefObject'
type: object
LinksActivate:
properties:
activate:
$ref: '#/components/schemas/LinksActivate_activate'
readOnly: true
type: object
LinksAerialConsentGranted:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
revoke:
$ref: '#/components/schemas/HrefObjectRevokeAerialConsent'
type: object
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
revoke:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksAerialConsentRevoked:
allOf:
- properties:
grant:
$ref: '#/components/schemas/HrefObjectGrantAerialConsent'
type: object
example:
grant:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksAppAndUser:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of resources related\
\ to the Application User."
example:
app:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
group:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
app:
$ref: '#/components/schemas/HrefObjectAppLink'
group:
$ref: '#/components/schemas/HrefObjectGroupLink'
user:
$ref: '#/components/schemas/HrefObjectUserLink'
readOnly: true
type: object
LinksAssignee:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification."
example:
assignee:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
assignee:
$ref: '#/components/schemas/HrefObjectAssigneeLink'
type: object
LinksCancel:
properties:
cancel:
$ref: '#/components/schemas/LinksCancel_cancel'
readOnly: true
type: object
LinksCustomRoleResponse:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources."
properties:
assignee:
$ref: '#/components/schemas/HrefObjectAssigneeLink'
member:
$ref: '#/components/schemas/HrefObjectMemberLink'
permissions:
$ref: '#/components/schemas/HrefObjectPermissionsLink'
resource-set:
$ref: '#/components/schemas/HrefObjectResourceSetLink'
role:
$ref: '#/components/schemas/HrefObjectRoleLink'
type: object
LinksDeactivate:
properties:
deactivate:
$ref: '#/components/schemas/LinksDeactivate_deactivate'
readOnly: true
type: object
LinksEnroll:
properties:
enroll:
$ref: '#/components/schemas/LinksEnroll_enroll'
readOnly: true
type: object
LinksFactor:
properties:
factor:
$ref: '#/components/schemas/LinksFactor_factor'
readOnly: true
type: object
LinksGovernanceResources:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the resources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification."
properties:
resources:
$ref: '#/components/schemas/HrefObjectGovernanceResourcesLink'
readOnly: true
type: object
LinksGovernanceSources:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the sources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification."
properties:
assignee:
$ref: '#/components/schemas/HrefObjectUserLink'
self:
$ref: '#/components/schemas/HrefObjectSelfLink'
readOnly: true
type: object
LinksNext:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of an application using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. Use the `LinksNext` object for dynamic discovery of related\
\ resources and lifecycle operations."
example:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
next:
$ref: '#/components/schemas/HrefObject'
readOnly: true
type: object
LinksNextForRoleAssignments:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification."
example:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
next:
$ref: '#/components/schemas/LinksNextForRoleAssignments_next'
readOnly: true
type: object
LinksPoll:
properties:
poll:
$ref: '#/components/schemas/LinksPoll_poll'
readOnly: true
type: object
LinksQrcode:
properties:
qrcode:
$ref: '#/components/schemas/LinksQrcode_qrcode'
readOnly: true
type: object
LinksQuestions:
properties:
question:
$ref: '#/components/schemas/LinksQuestions_question'
readOnly: true
type: object
LinksResend:
properties:
resend:
$ref: '#/components/schemas/LinksResend_resend'
readOnly: true
type: object
LinksSelf:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources\
\ and lifecycle operations."
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
self:
$ref: '#/components/schemas/HrefObjectSelfLink'
readOnly: true
type: object
LinksSelfAndFullUsersLifecycle:
allOf:
- $ref: '#/components/schemas/LinksSelfAndLifecycle'
- properties:
suspend:
$ref: '#/components/schemas/HrefObjectSuspendLink'
unsuspend:
$ref: '#/components/schemas/HrefObjectUnsuspendLink'
users:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: Link to Device users
type: object
example:
suspend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
unsuspend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users: ""
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksSelfAndLifecycle:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
activate:
$ref: '#/components/schemas/HrefObjectActivateLink'
deactivate:
$ref: '#/components/schemas/HrefObjectDeactivateLink'
type: object
example:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksSelfAndRoles:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
roles:
$ref: '#/components/schemas/HrefObjectRoleLink'
type: object
example:
roles:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksSelfForRoleAssignment:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources."
properties:
self:
$ref: '#/components/schemas/HrefObjectSelfLink'
type: object
LinksSelfLifecycleAndAuthorize:
allOf:
- $ref: '#/components/schemas/LinksSelfAndLifecycle'
- properties:
authorize:
$ref: '#/components/schemas/HrefObjectAuthorizeLink'
type: object
example:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
authorize:
hints:
allow:
- DELETE
- DELETE
guidance:
- guidance
- guidance
href: href
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksSend:
properties:
send:
$ref: '#/components/schemas/LinksSend_send'
readOnly: true
type: object
LinksUser:
properties:
user:
$ref: '#/components/schemas/LinksUser_user'
readOnly: true
type: object
LinksUserRef:
properties:
user:
$ref: '#/components/schemas/HrefObjectUserLink'
type: object
LinksVerify:
properties:
verify:
$ref: '#/components/schemas/LinksVerify_verify'
readOnly: true
type: object
ListProfileMappings:
description: |-
A collection of the profile mappings that include a subset of the profile mapping object's properties. The Profile Mapping object describes a mapping between an Okta User's and an App User's properties using [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04).
> **Note:** Same type source/target mappings aren't supported by this API. Profile mappings must either be Okta->App or App->Okta.
example:
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
source:
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: type
target:
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: type
properties:
id:
description: Unique identifier for profile mapping
readOnly: true
type: string
source:
$ref: '#/components/schemas/ProfileMappingSource'
target:
$ref: '#/components/schemas/ProfileMappingTarget'
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
LoadingPageTouchPointVariant:
default: OKTA_DEFAULT
description: |
Variant for the Okta loading page. You can publish a theme for Okta loading page with different combinations of assets. Variants are preset combinations of those assets.
enum:
- NONE
- OKTA_DEFAULT
type: string
x-enumDescriptions:
NONE: Uses no loading page animation during the redirect
OKTA_DEFAULT: Uses the default Okta loading page animation during the redirect
LocationGranularity:
enum:
- CITY
- COUNTRY
- LAT_LONG
- SUBDIVISION
type: string
LogActor:
description: "Describes the user, app, client, or other entity (actor) who performs\
\ an action on a target. The actor is dependent on the action that is performed.\
\ All events have actors."
example:
alternateId: alternateId
displayName: displayName
id: id
detailEntry:
key: ""
type: type
properties:
alternateId:
description: Alternative ID of the actor
readOnly: true
type: string
detailEntry:
additionalProperties: true
description: Further details about the actor
readOnly: true
type: object
displayName:
description: Display name of the actor
readOnly: true
type: string
id:
description: ID of the actor
readOnly: true
type: string
type:
description: Type of actor
readOnly: true
type: string
type: object
LogAuthenticationContext:
description: |-
All authentication relies on validating one or more credentials that prove the authenticity of the actor's identity. Credentials are sometimes provided by the actor, as is the case with passwords, and at other times provided by a third party, and validated by the authentication provider.
The authenticationContext contains metadata about how the actor is authenticated. For example, an authenticationContext for an event, where a user authenticates with Integrated Windows Authentication (IWA), looks like the following:
```
{
"authenticationProvider": "ACTIVE_DIRECTORY",
"authenticationStep": 0,
"credentialProvider": null,
"credentialType": "IWA",
"externalSessionId": "102N1EKyPFERROGvK9wizMAPQ",
"interface": null,
"issuer": null
}
```
In this case, the user enters an IWA credential to authenticate against an Active Directory instance. All of the user's future-generated events in this sign-in session are going to share the same `externalSessionId`.
Among other operations, this response object can be used to scan for suspicious sign-in activity or perform analytics on user authentication habits (for example, how often authentication scheme X is used versus authentication scheme Y).
example:
credentialType: ASSERTION
authenticationProvider: ACTIVE_DIRECTORY
credentialProvider: DUO
externalSessionId: externalSessionId
interface: interface
authenticationStep: 0
issuer:
id: id
type: type
properties:
authenticationProvider:
$ref: '#/components/schemas/LogAuthenticationProvider'
authenticationStep:
description: The zero-based step number in the authentication pipeline.
Currently unused and always set to `0`.
readOnly: true
type: integer
credentialProvider:
$ref: '#/components/schemas/LogCredentialProvider'
credentialType:
$ref: '#/components/schemas/LogCredentialType'
externalSessionId:
description: "A proxy for the actor's [session ID](https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html)"
readOnly: true
type: string
interface:
description: "The third-party user interface that the actor authenticates\
\ through, if any."
readOnly: true
type: string
issuer:
$ref: '#/components/schemas/LogIssuer'
type: object
LogAuthenticationProvider:
description: The system that proves the identity of an actor using the credentials
provided to it
enum:
- ACTIVE_DIRECTORY
- FACTOR_PROVIDER
- FEDERATION
- LDAP
- OKTA_AUTHENTICATION_PROVIDER
- SOCIAL
type: string
LogClient:
description: "When an event is triggered by an HTTP request, the `client` object\
\ describes the [client](https://datatracker.ietf.org/doc/html/rfc2616) that\
\ issues the HTTP request. For instance, the web browser is the client when\
\ a user accesses Okta. When this request is received and processed, a sign-in\
\ event is fired. When the event isn't sourced to an HTTP request, such as\
\ an automatic update, the `client` object field is blank."
example:
zone: zone
ipAddress: ipAddress
userAgent:
os: os
browser: browser
rawUserAgent: rawUserAgent
id: id
device: device
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
properties:
device:
description: "Type of device that the client operates from (for example,\
\ computer)"
readOnly: true
type: string
geographicalContext:
$ref: '#/components/schemas/LogGeographicalContext'
id:
description: "For OAuth requests, this is the ID of the OAuth [client](https://datatracker.ietf.org/doc/html/rfc6749#section-1.1)\
\ making the request. For SSWS token requests, this is the ID of the agent\
\ making the request."
readOnly: true
type: string
ipAddress:
description: IP address that the client is making its request from
readOnly: true
type: string
userAgent:
$ref: '#/components/schemas/LogUserAgent'
zone:
description: "The `name` of the [Zone](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/NetworkZone/#tag/NetworkZone/operation/getNetworkZone)\
\ that the client's location is mapped to"
readOnly: true
type: string
type: object
LogCredentialProvider:
description: "A credential provider is a software service that manages identities\
\ and their associated credentials. When authentication occurs through credentials\
\ provided by a credential provider, the credential provider is recorded here."
enum:
- DUO
- GOOGLE
- OKTA_AUTHENTICATION_PROVIDER
- OKTA_CREDENTIAL_PROVIDER
- RSA
- SYMANTEC
- YUBIKEY
type: string
LogCredentialType:
description: The underlying technology/scheme used in the credential
enum:
- ASSERTION
- CERTIFICATE
- DEVICE_UDID
- EMAIL
- IWA
- JWT
- OAuth 2.0
- OKTA_CLIENT_SESSION
- OTP
- PASSWORD
- PRE_SHARED_SYMMETRIC_KEY
- SMS
type: string
LogDebugContext:
description: |-
For some kinds of events (for example, OLM provisioning, sign-in request, second factor SMS, and so on), the fields that are provided in other response objects aren't sufficient to adequately describe the operations that the event has performed. In such cases, the `debugContext` object provides a way to store additional information.
For example, an event where a second factor SMS token is sent to a user may have a `debugContext` that looks like the following:
```
{
"debugData": {
"requestUri": "/api/v1/users/00u3gjksoiRGRAZHLSYV/factors/smsf8luacpZJAva10x45/verify",
"smsProvider": "TELESIGN",
"transactionId": "268632458E3C100F5F5F594C6DC689D4"
}
}
```
By inspecting the debugData field, you can find the URI that is used to trigger the second factor SMS (`/api/v1/users/00u3gjksoiRGRAZHLSYV/factors/smsf8luacpZJAva10x45/verify`), the SMS provider (`TELESIGN`), and the ID used by Telesign to identify this transaction (`268632458E3C100F5F5F594C6DC689D4`).
If for some reason the information that is needed to implement a feature isn't provided in other response objects, you should scan the `debugContext.debugData` field for potentially useful fields.
> **Important:** The information contained in `debugContext.debugData` is intended to add context when troubleshooting customer platform issues. Both key names and values may change from release to release and aren't guaranteed to be stable. Therefore, they shouldn't be viewed as a data contract but as a debugging aid instead.
example:
debugData:
key: ""
properties:
debugData:
additionalProperties: true
description: A dynamic field that contains miscellaneous information that
is dependent on the event type.
readOnly: true
type: object
type: object
LogDevice:
description: The entity that describes a device enrolled with passwordless authentication
using Okta Verify.
example:
LogDeviceObject:
$ref: '#/components/examples/LogDeviceObject'
properties:
device_integrator:
description: The integration platform or software used with the device
readOnly: true
type: object
disk_encryption_type:
$ref: '#/components/schemas/LogDiskEncryptionType'
id:
description: ID of the device
readOnly: true
type: string
jailbreak:
description: If the device has removed software restrictions
readOnly: true
type: boolean
managed:
description: Indicates if the device is configured for device management
and is registered with Okta
readOnly: true
type: boolean
name:
readOnly: true
type: string
os_platform:
readOnly: true
type: string
os_version:
readOnly: true
type: string
registered:
description: Indicates if the device is registered with an Okta org and
is bound to an Okta Verify instance on the device
readOnly: true
type: boolean
screen_lock_type:
$ref: '#/components/schemas/LogScreenLockType'
secure_hardware_present:
description: The availability of hardware security on the device
readOnly: true
type: boolean
type: object
LogDiskEncryptionType:
enum:
- ALL_INTERNAL_VALUES
- FULL
- NONE
- SYSTEM_VOLUME
- USER
type: string
LogEvent:
example:
severity: DEBUG
request:
ipChain:
- ip: ip
source: source
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
version: version
- ip: ip
source: source
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
version: version
authenticationContext:
credentialType: ASSERTION
authenticationProvider: ACTIVE_DIRECTORY
credentialProvider: DUO
externalSessionId: externalSessionId
interface: interface
authenticationStep: 0
issuer:
id: id
type: type
eventType: eventType
published: 2000-01-23T04:56:07.000+00:00
securityContext:
asNumber: 5
domain: domain
isp: isp
isProxy: true
asOrg: asOrg
uuid: uuid
version: version
target:
- alternateId: alternateId
displayName: displayName
id: id
detailEntry:
key: ""
type: type
changeDetails:
LogTargetChangeDetails:
$ref: '#/components/examples/LogTargetChangeDetails'
- alternateId: alternateId
displayName: displayName
id: id
detailEntry:
key: ""
type: type
changeDetails:
LogTargetChangeDetails:
$ref: '#/components/examples/LogTargetChangeDetails'
actor:
alternateId: alternateId
displayName: displayName
id: id
detailEntry:
key: ""
type: type
debugContext:
debugData:
key: ""
displayMessage: displayMessage
client:
zone: zone
ipAddress: ipAddress
userAgent:
os: os
browser: browser
rawUserAgent: rawUserAgent
id: id
device: device
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
legacyEventType: legacyEventType
outcome:
result: SUCCESS
reason: reason
transaction:
detail:
key: ""
id: id
type: type
properties:
actor:
$ref: '#/components/schemas/LogActor'
authenticationContext:
$ref: '#/components/schemas/LogAuthenticationContext'
client:
$ref: '#/components/schemas/LogClient'
debugContext:
$ref: '#/components/schemas/LogDebugContext'
displayMessage:
description: The display message for an event
readOnly: true
type: string
eventType:
description: Type of event that is published
readOnly: true
type: string
legacyEventType:
description: Associated Events API Action `objectType` attribute value
readOnly: true
type: string
outcome:
$ref: '#/components/schemas/LogOutcome'
published:
description: Timestamp when the event is published
format: date-time
readOnly: true
type: string
request:
$ref: '#/components/schemas/LogRequest'
securityContext:
$ref: '#/components/schemas/LogSecurityContext'
severity:
$ref: '#/components/schemas/LogSeverity'
target:
items:
$ref: '#/components/schemas/LogTarget'
readOnly: true
type: array
transaction:
$ref: '#/components/schemas/LogTransaction'
uuid:
description: Unique identifier for an individual event
readOnly: true
type: string
version:
description: Versioning indicator
readOnly: true
type: string
type: object
LogGeographicalContext:
description: "Geographical context describes a set of geographic coordinates.\
\ In addition to containing latitude and longitude data, the `GeographicalContext`\
\ object also contains address data of postal code-level granularity. Within\
\ the `Client` object, the geographical context refers to the physical location\
\ of the client when it sends the request that triggers this event. All `Transaction`\
\ events with `type` equal to `WEB` have a geographical context set. `Transaction`\
\ events with `type` equal to `JOB` don't have a geographical context set.\
\ The geographical context data can be missing if the geographical data for\
\ a request can't be resolved."
example:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
properties:
city:
description: "The city that encompasses the area that contains the geolocation\
\ coordinates, if available (for example, Seattle, San Francisco)"
readOnly: true
type: string
country:
description: "Full name of the country that encompasses the area that contains\
\ the geolocation coordinates (for example, France, Uganda)"
readOnly: true
type: string
geolocation:
$ref: '#/components/schemas/LogGeolocation'
postalCode:
description: Postal code of the area that encompasses the geolocation coordinates
readOnly: true
type: string
state:
description: "Full name of the state or province that encompasses the area\
\ that contains the geolocation coordinates (for example, Montana, Ontario)"
readOnly: true
type: string
type: object
LogGeolocation:
description: "The latitude and longitude of the geolocation where an action\
\ was performed. The object is formatted according to the [ISO-6709](https://www.iso.org/obp/ui/fr/#iso:std:iso:6709:ed-3:v1:en)\
\ standard."
example:
lon: 1.4658129805029452
lat: 6.027456183070403
properties:
lat:
description: "Latitude which uses two digits for the [integer part](https://www.iso.org/obp/ui/fr/#iso:std:iso:6709:ed-3:v1:en#Latitude)"
format: double
readOnly: true
type: number
lon:
description: "Longitude which uses three digits for the [integer part](https://www.iso.org/obp/ui/fr/#iso:std:iso:6709:ed-3:v1:en#Longitude)"
format: double
readOnly: true
type: number
type: object
LogIpAddress:
example:
ip: ip
source: source
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
version: version
properties:
geographicalContext:
$ref: '#/components/schemas/LogGeographicalContext'
ip:
description: IP address
readOnly: true
type: string
source:
description: Details regarding the source
readOnly: true
type: string
version:
description: IP address version
readOnly: true
type: string
type: object
LogIssuer:
description: Describes the issuer of the authorization server when the authentication
is performed through OAuth. This is the location where well-known resources
regarding the details of the authorization servers are published.
example:
id: id
type: type
properties:
id:
description: "Varies depending on the type of authentication. If authentication\
\ is SAML 2.0, `id` is the issuer in the SAML assertion. For social login,\
\ `id` is the issuer of the token."
readOnly: true
type: string
type:
description: Information on the `issuer` and source of the SAML assertion
or token
readOnly: true
type: string
type: object
LogOutcome:
example:
result: SUCCESS
reason: reason
properties:
reason:
description: "Reason for the result, for example, `INVALID_CREDENTIALS`"
maxLength: 255
minLength: 1
readOnly: true
type: string
result:
description: Result of the action
enum:
- SUCCESS
- FAILURE
- SKIPPED
- ALLOW
- DENY
- CHALLENGE
- UNKNOWN
readOnly: true
type: string
type: object
LogRequest:
description: "The `Request` object describes details that are related to the\
\ HTTP request that triggers this event, if available. When the event isn't\
\ sourced to an HTTP request, such as an automatic update on the Okta servers,\
\ the `Request` object still exists, but the `ipChain` field is empty."
example:
ipChain:
- ip: ip
source: source
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
version: version
- ip: ip
source: source
geographicalContext:
country: country
city: city
postalCode: postalCode
state: state
geolocation:
lon: 1.4658129805029452
lat: 6.027456183070403
version: version
properties:
ipChain:
description: "If the incoming request passes through any proxies, the IP\
\ addresses of those proxies are stored here in the format of clientIp,\
\ proxy1, proxy2, and so on. This field is useful when working with trusted\
\ proxies."
items:
$ref: '#/components/schemas/LogIpAddress'
readOnly: true
type: array
type: object
LogScreenLockType:
enum:
- BIOMETRIC
- NONE
- PASSCODE
type: string
LogSecurityContext:
description: "The `securityContext` object provides security information that\
\ is directly related to the evaluation of the event's IP reputation. IP reputation\
\ is a trustworthiness rating that evaluates how likely a sender is to be\
\ malicious and is based on the sender's IP address. As the name implies,\
\ the `securityContext` object is useful for security applications-flagging\
\ and inspecting suspicious events."
example:
asNumber: 5
domain: domain
isp: isp
isProxy: true
asOrg: asOrg
properties:
asNumber:
description: "The [Autonomous system](https://docs.telemetry.mozilla.org/datasets/other/asn_aggregates/reference)\
\ number that's associated with the autonomous system the event request\
\ was sourced to"
readOnly: true
type: integer
asOrg:
description: The organization that is associated with the autonomous system
that the event request is sourced to
readOnly: true
type: string
domain:
description: The domain name that's associated with the IP address of the
inbound event request
readOnly: true
type: string
isp:
description: The Internet service provider that's used to send the event's
request
readOnly: true
type: string
isProxy:
description: Specifies whether an event's request is from a known proxy
readOnly: true
type: boolean
type: object
LogSeverity:
description: Indicates how severe the event is
enum:
- DEBUG
- ERROR
- INFO
- WARN
type: string
LogStream:
discriminator:
mapping:
aws_eventbridge: '#/components/schemas/LogStreamAws'
splunk_cloud_logstreaming: '#/components/schemas/LogStreamSplunk'
propertyName: type
example:
lastUpdated: 2022-10-21T17:15:10Z
_links:
activate:
method: GET
href: href
self:
method: GET
href: href
deactivate:
method: GET
href: href
created: 2022-10-21T16:59:59Z
name: My AWS EventBridge log stream
id: 0oa1orzg0CHSgPcjZ0g4
type: aws_eventbridge
status: ACTIVE
properties:
created:
description: Timestamp when the Log Stream object was created
example: 2022-10-21T16:59:59Z
format: date-time
readOnly: true
type: string
id:
description: Unique identifier for the Log Stream
example: 0oa1orzg0CHSgPcjZ0g4
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Log Stream object was last updated
example: 2022-10-21T17:15:10Z
format: date-time
readOnly: true
type: string
name:
description: Unique name for the Log Stream object
example: My AWS EventBridge log stream
type: string
status:
description: Lifecycle status of the Log Stream object
enum:
- ACTIVE
- INACTIVE
readOnly: true
type: string
type:
$ref: '#/components/schemas/LogStreamType'
_links:
$ref: '#/components/schemas/LogStreamLinksSelfAndLifecycle'
required:
- _links
- created
- id
- lastUpdated
- name
- status
- type
type: object
LogStreamActivateLink:
allOf:
- $ref: '#/components/schemas/LogStreamLinkObject'
- description: Link to activate the resource
example:
method: GET
href: href
LogStreamAws:
allOf:
- $ref: '#/components/schemas/LogStream'
- properties:
settings:
$ref: '#/components/schemas/LogStreamSettingsAws'
required:
- settings
type: object
LogStreamAwsPutSchema:
allOf:
- $ref: '#/components/schemas/LogStreamPutSchema'
- properties:
settings:
$ref: '#/components/schemas/LogStreamSettingsAws'
required:
- settings
type: object
LogStreamDeactivateLink:
allOf:
- $ref: '#/components/schemas/LogStreamLinkObject'
- description: Link to deactivate the resource
example:
method: GET
href: href
LogStreamLinkObject:
properties:
href:
description: The URI of the resource
type: string
method:
description: HTTP method allowed for the resource
enum:
- GET
- POST
type: string
readOnly: true
required:
- href
title: Log Stream Link object
type: object
LogStreamLinksSelfAndLifecycle:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of an application using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources\
\ and lifecycle operations."
example:
activate:
method: GET
href: href
self:
method: GET
href: href
deactivate:
method: GET
href: href
properties:
activate:
$ref: '#/components/schemas/LogStreamActivateLink'
deactivate:
$ref: '#/components/schemas/LogStreamDeactivateLink'
self:
$ref: '#/components/schemas/LogStreamSelfLink'
readOnly: true
required:
- self
type: object
LogStreamName:
description: Unique name for the Log Stream object
example: My AWS EventBridge log stream
type: string
LogStreamPutSchema:
discriminator:
mapping:
aws_eventbridge: '#/components/schemas/LogStreamAwsPutSchema'
splunk_cloud_logstreaming: '#/components/schemas/LogStreamSplunkPutSchema'
propertyName: type
example:
name: My AWS EventBridge log stream
type: aws_eventbridge
properties:
name:
description: Unique name for the Log Stream object
example: My AWS EventBridge log stream
type: string
type:
$ref: '#/components/schemas/LogStreamType'
required:
- name
- type
type: object
LogStreamSchema:
example:
oneOf:
- const: const
title: title
- const: const
title: title
$schema: $schema
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
errorMessage: "{}"
pattern: pattern
id: id
title: title
type: type
properties: "{}"
required:
- required
- required
properties:
$schema:
description: JSON Schema version identifier
readOnly: true
type: string
errorMessage:
description: "A collection of error messages for individual properties in\
\ the schema. Okta implements a subset of [ajv-errors](https://github.com/ajv-validator/ajv-errors)."
type: object
id:
description: URI of Log Stream Schema
readOnly: true
type: string
oneOf:
description: |-
Non-empty array of valid JSON schemas.
Okta only supports `oneOf` for specifying display names for an `enum`. Each schema has the following format:
```
{
"const": "enumValue",
"title": "display name"
}
```json
items:
$ref: '#/components/schemas/UserSchemaAttributeEnum'
nullable: true
type: array
pattern:
description: "For `string` Log Stream Schema property type, specifies the\
\ regular expression used to validate the property"
type: string
properties:
description: Log Stream Schema properties object
type: object
required:
description: Required properties for this Log Stream Schema object
items:
type: string
type: array
title:
description: Name of the Log Streaming integration
type: string
type:
description: Type of Log Stream Schema property
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
LogStreamSelfLink:
allOf:
- $ref: '#/components/schemas/LogStreamLinkObject'
- description: Link to the resource (self)
example:
method: GET
href: href
LogStreamSettingsAws:
description: Specifies the configuration for the `aws_eventbridge` Log Stream
type. This configuration can't be modified after creation.
properties:
accountId:
description: Your AWS account ID
example: "123456789012"
maxLength: 12
minLength: 12
type: string
eventSourceName:
description: An alphanumeric name (no spaces) to identify this event source
in AWS EventBridge
example: your-event-source-name
maxLength: 75
minLength: 1
pattern: "^[a-zA-Z0-9.\\-_]$"
type: string
region:
$ref: '#/components/schemas/AwsRegion'
required:
- accountId
- eventSourceName
- region
type: object
LogStreamSettingsSplunk:
description: Specifies the configuration for the `splunk_cloud_logstreaming`
Log Stream type.
properties:
edition:
$ref: '#/components/schemas/SplunkEdition'
host:
description: "The domain name for your Splunk Cloud instance. Don't include\
\ `http` or `https` in the string. For example: `acme.splunkcloud.com`"
example: acme.splunkcloud.com
maxLength: 116
minLength: 17
type: string
token:
description: "The HEC token for your Splunk Cloud HTTP Event Collector.\
\ The token value is set at object creation, but isn't returned."
example: 11111111-1111-2222-2222-222222222222
pattern: "(?i)^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
type: string
writeOnly: true
required:
- edition
- host
- token
type: object
LogStreamSettingsSplunkPut:
description: Specifies the configuration for the `splunk_cloud_logstreaming`
Log Stream type.
properties:
edition:
$ref: '#/components/schemas/SplunkEdition'
host:
description: "The domain name for your Splunk Cloud instance. Don't include\
\ `http` or `https` in the string. For example: `acme.splunkcloud.com`"
example: acme.splunkcloud.com
maxLength: 116
minLength: 17
type: string
required:
- edition
- host
type: object
LogStreamSplunk:
allOf:
- $ref: '#/components/schemas/LogStream'
- properties:
settings:
$ref: '#/components/schemas/LogStreamSettingsSplunk'
required:
- settings
type: object
LogStreamSplunkPutSchema:
allOf:
- $ref: '#/components/schemas/LogStreamPutSchema'
- properties:
settings:
$ref: '#/components/schemas/LogStreamSettingsSplunkPut'
required:
- settings
type: object
LogStreamType:
description: |-
Specifies the streaming provider used
Supported providers:
* `aws_eventbridge` ([AWS EventBridge](https://aws.amazon.com/eventbridge))
* `splunk_cloud_logstreaming` ([Splunk Cloud](https://www.splunk.com/en_us/software/splunk-cloud-platform.html))
Select the provider type to see provider-specific configurations in the `settings` property:
enum:
- aws_eventbridge
- splunk_cloud_logstreaming
type: string
LogTarget:
description: "The entity that an actor performs an action on. Targets can be\
\ anything, such as an app user, a sign-in token, or anything else."
example:
alternateId: alternateId
displayName: displayName
id: id
detailEntry:
key: ""
type: type
changeDetails:
LogTargetChangeDetails:
$ref: '#/components/examples/LogTargetChangeDetails'
properties:
alternateId:
description: The alternate ID of the target
readOnly: true
type: string
changeDetails:
$ref: '#/components/schemas/LogTarget_changeDetails'
detailEntry:
additionalProperties: true
description: Further details on the target
readOnly: true
type: object
displayName:
description: The display name of the target
readOnly: true
type: string
id:
description: The ID of the target
readOnly: true
type: string
type:
description: The type of target
readOnly: true
type: string
type: object
LogTransaction:
description: "A `transaction` object comprises contextual information associated\
\ with its respective event. \nThis information is useful for understanding\
\ sequences of correlated events.\nFor example, a `transaction` object such\
\ as the following:\n```\n{\n \"id\": \"Wn4f-0RQ8D8lTSLkAmkKdQAADqo\",\n\
\ \"type\": \"WEB\",\n \"detail\": null\n}\n```\nindicates that a `WEB`\
\ request with `id` `Wn4f-0RQ8D8lTSLkAmkKdQAADqo` has created this event.\n\
\nA `transaction` object with a `requestApiTokenId` in the `detail` object,\
\ for example :\n```\n{\n \"id\": \"YjSlblAAqnKY7CdyCkXNBgAAAIU\",\n \"\
type\": \"WEB\",\n \"detail\": {\n \"requestApiTokenId\": \"00T94e3cn9kSEO3c51s5\"\
\n }\n}\n```\nindicates that this event was the result of an action performed\
\ through an API using the token identified by 00T94e3cn9kSEO3c51s5. The token\
\ ID is visible in the Admin Console, **Security** > **API**. See [API token\
\ management](https://help.okta.com/okta_help.htm?id=Security_API). For more\
\ information on API tokens, see [Create an API token](https://developer.okta.com/docs/guides/create-an-api-token/)."
example:
detail:
key: ""
id: id
type: type
properties:
detail:
additionalProperties: true
description: Details for this transaction.
readOnly: true
type: object
id:
description: Unique identifier for this transaction.
readOnly: true
type: string
type:
description: Describes the kind of transaction. `WEB` indicates a web request.
`JOB` indicates an asynchronous task.
readOnly: true
type: string
type: object
LogUserAgent:
description: |
"A user agent is software (a software agent) that is acting on behalf of a user." ([Definition of User Agent](https://developer.mozilla.org/en-US/docs/Glossary/User_agent))
In the Okta event data object, the `UserAgent` object provides specifications about the client software that makes event-triggering HTTP requests. User agent identification is often useful for identifying interoperability problems between servers and clients, and also for browser and operating system usage analytics.
example:
os: os
browser: browser
rawUserAgent: rawUserAgent
properties:
browser:
description: "If the client is a web browser, this field identifies the\
\ type of web browser (for example, CHROME, FIREFOX)"
readOnly: true
type: string
os:
description: "The operating system that the client runs on (for example,\
\ Windows 10)"
readOnly: true
type: string
rawUserAgent:
description: "A raw string representation of the user agent that is formatted\
\ according to [section 5.5.3 of HTTP/1.1 Semantics and Content](https://datatracker.ietf.org/doc/html/rfc7231#section-5.5.3).\
\ Both the `browser` and the `OS` fields can be derived from this field."
readOnly: true
type: string
type: object
MDMEnrollmentPolicyEnrollment:
enum:
- ANY_OR_NONE
- OMM
type: string
MDMEnrollmentPolicyRuleCondition:
properties:
blockNonSafeAndroid:
type: boolean
enrollment:
$ref: '#/components/schemas/MDMEnrollmentPolicyEnrollment'
type: object
MetadataLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [SAML metadata](/openapi/okta-management/management/tag/ApplicationSSO/#tag/ApplicationSSO/operation/previewSAMLmetadataForApplication)\
\ for SSO"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
MtlsCredentials:
description: Certificate chain description for verifying assertions from the
Smart Card
properties:
trust:
$ref: '#/components/schemas/MtlsTrustCredentials'
type: object
MtlsEndpoints:
properties:
sso:
$ref: '#/components/schemas/MtlsSsoEndpoint'
type: object
MtlsSsoEndpoint:
description: The Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService`
endpoint
properties:
url:
example: "https://{yourOktaDomain}.okta.com/login/cert"
maxLength: 1014
type: string
type: object
MtlsTrustCredentials:
properties:
audience:
description: Not used
type: string
example: null
issuer:
description: Description of the certificate issuer
example: "CN=Test Smart Card, OU=Test OU, O=Test O, C=US"
maxLength: 1024
type: string
kid:
description: IdP Key Credential reference to the Okta X.509 signature certificate
example: your-key-id
type: string
revocation:
$ref: '#/components/schemas/MtlsTrustCredentialsRevocation'
revocationCacheLifetime:
description: Time in minutes to cache the certificate revocation information
example: 2880
maximum: 4320
type: number
type: object
MtlsTrustCredentialsRevocation:
description: Mechanism to validate the certificate
enum:
- CRL
- DELTA_CRL
- OCSP
example: CRL
type: string
NetworkZone:
discriminator:
mapping:
IP: '#/components/schemas/IPNetworkZone'
DYNAMIC: '#/components/schemas/DynamicNetworkZone'
DYNAMIC_V2: '#/components/schemas/EnhancedDynamicNetworkZone'
propertyName: type
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
system: true
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
usage: BLOCKLIST
name: name
id: id
type: DYNAMIC
status: ACTIVE
properties:
created:
description: Timestamp when the object was created
format: date-time
readOnly: true
type: string
id:
description: Unique identifier for the Network Zone
readOnly: true
type: string
lastUpdated:
description: Timestamp when the object was last modified
format: date-time
readOnly: true
type: string
name:
description: Unique name for this Network Zone
maxLength: 128
type: string
status:
$ref: '#/components/schemas/NetworkZoneStatus'
system:
description: |
Indicates a system Network Zone:
* `true` for system Network Zones
* `false` for custom Network Zones
The Okta org provides the following default system Network Zones:
* `LegacyIpZone`
* `BlockedIpZone`
* `DefaultEnhancedDynamicZone`
Admins can modify the name of the default system Network Zone and add up to 5000 gateway or proxy IP entries.
readOnly: true
type: boolean
type:
$ref: '#/components/schemas/NetworkZoneType'
usage:
$ref: '#/components/schemas/NetworkZoneUsage'
_links:
$ref: '#/components/schemas/LinksSelfAndLifecycle'
required:
- name
- type
type: object
NetworkZoneAddress:
description: Specifies the value of an IP address expressed using either `range`
or `CIDR` form.
properties:
type:
$ref: '#/components/schemas/NetworkZoneAddressType'
value:
description: "Value in CIDR/range form, depending on the `type` specified"
type: string
type: object
NetworkZoneAddressType:
description: Format of the IP addresses
enum:
- CIDR
- RANGE
type: string
NetworkZoneAsns:
items:
type: string
maximum: 75
type: array
NetworkZoneLocation:
properties:
country:
description: |-
The two-character ISO-3166-1 country code.
Don't use continent codes since they are treated as generic codes for undesignated countries.
<br>For example: `US`
maxLength: 2
minLength: 2
type: string
region:
description: |-
(Optional) The ISO-3166-2 region code appended to the country code (`countryCode-regionCode`), or `null` if empty.
Don't use continent codes since they are treated as generic codes for undesignated regions.
<br>For example: `CA` (for `US-CA` country and region code)
type: string
type: object
NetworkZoneLocationArray:
items:
$ref: '#/components/schemas/NetworkZoneLocation'
maximum: 75
nullable: true
type: array
NetworkZoneStatus:
description: Network Zone status
enum:
- ACTIVE
- INACTIVE
type: string
NetworkZoneType:
description: The type of Network Zone
enum:
- DYNAMIC
- IP
- DYNAMIC_V2
type: string
NetworkZoneUsage:
description: The usage of the Network Zone
enum:
- BLOCKLIST
- POLICY
type: string
NotificationType:
description: The type of notification
enum:
- AD_AGENT
- AGENT_AUTO_UPDATE_NOTIFICATION
- AGENT_AUTO_UPDATE_NOTIFICATION_LDAP
- APP_IMPORT
- CONNECTOR_AGENT
- IWA_AGENT
- LDAP_AGENT
- OKTA_ANNOUNCEMENT
- OKTA_ISSUE
- OKTA_UPDATE
- RATELIMIT_NOTIFICATION
- REPORT_SUSPICIOUS_ACTIVITY
- USER_DEPROVISION
- USER_LOCKED_OUT
type: string
x-enumDescriptions:
AD_AGENT: System notification sent when an AD agent disconnects or reconnects
AGENT_AUTO_UPDATE_NOTIFICATION: System notification sent when an agent automatically
updates
APP_IMPORT: System notification sent with the status of an app user import
CONNECTOR_AGENT: System notification sent when an on-premises provisioning
or Okta on-prem MFA agent disconnects or reconnects
IWA_AGENT: System notification sent when an IGA agent disconnects or reconnects
LDAP_AGENT: System notification sent when an LDAP agent disconnects or reconnects
OKTA_ANNOUNCEMENT: Okta communication sent for announcements and release notes
OKTA_ISSUE: Okta communication sent for trust incident alerts and updates
OKTA_UPDATE: Okta communication sent for scheduled system updates
RATELIMIT_NOTIFICATION: System notification sent when an org reaches rate
limit warning or violation thresholds
REPORT_SUSPICIOUS_ACTIVITY: System notification sent when a user reports suspicious
activity
USER_DEPROVISION: System notification sent when a user is deprovisioned from
apps
USER_LOCKED_OUT: System notification sent when a user is locked out from logging
in to Okta
OAuth2Actor:
description: User that created the object
example:
id: 00u5t60iloOHN9pBi0h7
type: User
properties:
id:
description: User ID
example: 00u5t60iloOHN9pBi0h7
readOnly: true
type: string
type:
description: Type of user
example: User
type: string
readOnly: true
type: object
OAuth2Claim:
example:
group_filter_type: CONTAINS
claimType: IDENTITY
system: true
alwaysIncludeInToken: true
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
valueType: EXPRESSION
name: name
id: id
conditions:
scopes:
- scopes
- scopes
value: value
status: ACTIVE
properties:
alwaysIncludeInToken:
description: "Specifies whether to include Claims in the token. The value\
\ is always `TRUE` for access token Claims. If the value is set to `FALSE`\
\ for an ID token claim, the Claim isn't included in the ID token when\
\ the token is requested with the access token or with the `authorization_code`.\
\ The client instead uses the access token to get Claims from the `/userinfo`\
\ endpoint."
type: boolean
claimType:
$ref: '#/components/schemas/OAuth2ClaimType'
conditions:
$ref: '#/components/schemas/OAuth2ClaimConditions'
group_filter_type:
$ref: '#/components/schemas/OAuth2ClaimGroupFilterType'
id:
description: ID of the Claim
readOnly: true
type: string
name:
description: Name of the Claim
type: string
status:
$ref: '#/components/schemas/LifecycleStatus'
system:
description: "When `true`, indicates that Okta created the Claim"
type: boolean
value:
description: "Specifies the value of the Claim. This value must be a string\
\ literal if `valueType` is `GROUPS`, and the string literal is matched\
\ with the selected `group_filter_type`. The value must be an Okta EL\
\ expression if `valueType` is `EXPRESSION`."
type: string
valueType:
$ref: '#/components/schemas/OAuth2ClaimValueType'
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
OAuth2ClaimConditions:
description: Specifies the scopes for the Claim
example:
scopes:
- scopes
- scopes
properties:
scopes:
items:
type: string
type: array
type: object
OAuth2ClaimGroupFilterType:
description: |-
Specifies the type of group filter if `valueType` is `GROUPS`
If `valueType` is `GROUPS`, then the groups returned are filtered according to the value of `group_filter_type`.
If you have complex filters for Groups, you can [create a Groups allowlist](https://developer.okta.com/docs/guides/customize-tokens-groups-claim/main/) to put them all in a Claim.
enum:
- CONTAINS
- EQUALS
- REGEX
- STARTS_WITH
type: string
x-enumDescriptions:
STARTS_WITH: "Group names start with `value` (not case-sensitive). For example,\
\ if `value` is `group1`, then `group123` and `Group123` are included."
EQUALS: "Group name is the same as `value` (not case-sensitive). For example,\
\ if `value` is `group1`, then `group1` and `Group1` are included, but `group123`\
\ isn't."
CONTAINS: "Group names contain `value` (not case-sensitive). For example,\
\ if `value` is `group1`, then `MyGroup123` and `group1` are included."
REGEX: "Group names match the regular expression in `value` (case-sensitive).\
\ For example if `value` is `/^[a-z0-9_-]{3,16}$/`, then any Group name\
\ that has at least three letters, no more than 16, and contains lowercase\
\ letters, a hyphen, or numbers is a match."
OAuth2ClaimType:
description: Specifies whether the Claim is for an access token (`RESOURCE`)
or an ID token (`IDENTITY`)
enum:
- IDENTITY
- RESOURCE
type: string
OAuth2ClaimValueType:
description: "Specifies whether the Claim is an Okta Expression Language (EL)\
\ expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim\
\ (`SYSTEM`)"
enum:
- EXPRESSION
- GROUPS
- SYSTEM
type: string
OAuth2Client:
example:
client_uri: https://www.example.com
_links:
grants: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
tokens: ""
logo_uri: https://www.example.com/logo.png
client_name: My App
client_id: 0oabskvc6442nkvQO0h7
properties:
client_id:
description: Unique key for the client application. The `client_id` is immutable.
example: 0oabskvc6442nkvQO0h7
readOnly: true
type: string
client_name:
description: Human-readable string name of the client application
example: My App
readOnly: true
type: string
client_uri:
example: https://www.example.com
readOnly: true
type: string
logo_uri:
description: URL string that references a logo for the client consent dialog
(not the sign-in dialog)
example: https://www.example.com/logo.png
readOnly: true
type: string
_links:
$ref: '#/components/schemas/OAuth2Client__links'
type: object
OAuth2ClientJsonWebKey:
example:
kty: RSA
lastUpdated: 2023-02-21T20:08:24.000Z
e: AQAB
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
delete:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2023-02-21T20:08:24.000Z
use: sig
kid: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4
id: pks2f4zrZbs8nUa7p0g4
alg: RS256
"n": mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ
status: ACTIVE
properties:
alg:
description: Algorithm used in the key
example: RS256
nullable: false
type: string
created:
description: Timestamp when the OAuth Client 2.0 JSON Web Key was created
example: 2023-02-21T20:08:24.000Z
nullable: false
readOnly: true
type: string
e:
description: RSA key value (exponent) for key binding
example: AQAB
nullable: false
type: string
id:
description: The unique ID of the OAuth Client JSON Web Key
example: pks2f4zrZbs8nUa7p0g4
nullable: false
readOnly: true
type: string
kid:
description: Unique identifier of the JSON Web Key in the OAUth 2.0 Client's
JWKS
example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4
nullable: true
type: string
kty:
description: Cryptographic algorithm family for the certificate's key pair
example: RSA
nullable: false
type: string
lastUpdated:
description: Timestamp when the OAuth Client 2.0 JSON Web Key was updated
example: 2023-02-21T20:08:24.000Z
nullable: false
readOnly: true
type: string
"n":
description: RSA key value (modulus) for key binding
example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ
nullable: false
type: string
status:
default: ACTIVE
description: Status of the OAuth 2.0 Client JSON Web Key
enum:
- ACTIVE
- INACTIVE
example: ACTIVE
nullable: false
type: string
use:
description: Acceptable use of the JSON Web Key
example: sig
nullable: false
type: string
_links:
$ref: '#/components/schemas/OAuthClientSecretLinks'
type: object
OAuth2ClientJsonWebKeyRequestBody:
example:
kty: RSA
e: AQAB
use: sig
kid: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4
alg: RS256
"n": mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ
status: ACTIVE
properties:
alg:
description: Algorithm used in the key
example: RS256
nullable: false
type: string
e:
description: RSA key value (exponent) for key binding
example: AQAB
nullable: false
type: string
kid:
description: Unique identifier of the JSON Web Key in the OAUth 2.0 Client's
JWKS
example: SIMcCQNY3uwXoW3y0vf6VxiBb5n9pf8L2fK8d-FIbm4
nullable: true
type: string
kty:
description: Cryptographic algorithm family for the certificate's key pair
example: RSA
nullable: false
type: string
"n":
description: RSA key value (modulus) for key binding
example: mkC6yAJVvFwUlmM9gKjb2d-YK5qHFt-mXSsbjWKKs4EfNm-BoQeeovBZtSACyaqLc8IYFTPEURFcbDQ9DkAL04uUIRD2gaHYY7uK0jsluEaXGq2RAIsmzAwNTzkiDw4q9pDL_q7n0f_SDt1TsMaMQayB6bU5jWsmqcWJ8MCRJ1aJMjZ16un5UVx51IIeCbe4QRDxEXGAvYNczsBoZxspDt28esSpq5W0dBFxcyGVudyl54Er3FzAguhgfMVjH-bUec9j2Tl40qDTktrYgYfxz9pfjm01Hl4WYP1YQxeETpSL7cQ5Ihz4jGDtHUEOcZ4GfJrPzrGpUrak8Qp5xcwCqQ
nullable: false
type: string
status:
description: Status of the OAuth 2.0 Client JSON Web Key
enum:
- ACTIVE
- INACTIVE
example: ACTIVE
type: string
use:
description: Acceptable use of the JSON Web Key
example: sig
nullable: false
type: string
type: object
OAuth2ClientSecret:
example:
lastUpdated: 2023-02-21T20:08:24.000Z
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
delete:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2023-02-21T20:08:24.000Z
secret_hash: yk4SVx4sUWVJVbHt6M-UPA
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
id: ocs2f4zrZbs8nUa7p0g4
status: ACTIVE
properties:
client_secret:
description: The OAuth 2.0 client secret string
example: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
nullable: false
readOnly: true
type: string
created:
description: Timestamp when the OAuth Client 2.0 Secret was created
example: 2023-02-21T20:08:24.000Z
nullable: false
readOnly: true
type: string
id:
description: The unique ID of the OAuth Client Secret
example: ocs2f4zrZbs8nUa7p0g4
nullable: false
readOnly: true
type: string
lastUpdated:
description: Timestamp when the OAuth Client 2.0 Secret was updated
example: 2023-02-21T20:08:24.000Z
nullable: false
readOnly: true
type: string
secret_hash:
description: OAuth 2.0 client secret string hash
example: yk4SVx4sUWVJVbHt6M-UPA
nullable: false
readOnly: true
type: string
status:
default: ACTIVE
description: Status of the OAuth 2.0 Client Secret
enum:
- ACTIVE
- INACTIVE
example: ACTIVE
nullable: false
type: string
_links:
$ref: '#/components/schemas/OAuthClientSecretLinks'
type: object
OAuth2ClientSecretRequestBody:
example:
client_secret: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
status: ACTIVE
properties:
client_secret:
description: The OAuth 2.0 client secret string
example: DRUFXGF9XbLn......a3x3POBiIxDreBCdZuFs5B
type: string
status:
description: Status of the OAuth 2.0 Client Secret
enum:
- ACTIVE
- INACTIVE
example: ACTIVE
type: string
type: object
OAuth2RefreshToken:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
clientId: clientId
_embedded:
scopes:
- _links:
scope: ""
displayName: displayName
name: offline_access
description: "Requests a refresh token by default, used to obtain more\
\ access tokens without re-prompting the user for authentication"
id: scppb56cIl4GvGxy70g3
- _links:
scope: ""
displayName: displayName
name: offline_access
description: "Requests a refresh token by default, used to obtain more\
\ access tokens without re-prompting the user for authentication"
id: scppb56cIl4GvGxy70g3
_links:
app: ""
authorizationServer: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
revoke:
hints:
allow:
- DELETE
- DELETE
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
client: ""
user: ""
created: 2017-03-28T01:11:10Z
id: oar579Mcp7OUsNTlo0g3
scopes:
- offline_access
- offline_access
userId: 00u5t60iloOHN9pBi0h7
expiresAt: 2000-01-23T04:56:07.000+00:00
issuer: "https://{yourOktaDomain}/oauth2/ausain6z9zIedDCxB0h7"
status: ACTIVE
properties:
clientId:
description: Client ID
type: string
created:
description: Timestamp when the object was created
example: 2017-03-28T01:11:10Z
format: date-time
readOnly: true
type: string
expiresAt:
description: Expiration time of the OAuth 2.0 Token
format: date-time
readOnly: true
type: string
id:
description: ID of the Token object
example: oar579Mcp7OUsNTlo0g3
readOnly: true
type: string
issuer:
description: The complete URL of the authorization server that issued the
Token
example: "https://{yourOktaDomain}/oauth2/ausain6z9zIedDCxB0h7"
type: string
lastUpdated:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
scopes:
description: The scope names attached to the Token
items:
example: offline_access
type: string
type: array
status:
$ref: '#/components/schemas/GrantOrTokenStatus'
userId:
description: The ID of the user associated with the Token
example: 00u5t60iloOHN9pBi0h7
type: string
_embedded:
$ref: '#/components/schemas/OAuth2RefreshToken__embedded'
_links:
$ref: '#/components/schemas/OAuth2RefreshToken__links'
type: object
OAuth2RefreshTokenScope:
example:
_links:
scope: ""
displayName: displayName
name: offline_access
description: "Requests a refresh token by default, used to obtain more access\
\ tokens without re-prompting the user for authentication"
id: scppb56cIl4GvGxy70g3
properties:
description:
description: Description of the Scope
example: "Requests a refresh token by default, used to obtain more access\
\ tokens without re-prompting the user for authentication"
type: string
displayName:
description: Name of the end user displayed in a consent dialog
type: string
id:
description: Scope object ID
example: scppb56cIl4GvGxy70g3
readOnly: true
type: string
name:
description: Scope name
example: offline_access
type: string
_links:
$ref: '#/components/schemas/OAuth2RefreshTokenScope__links'
type: object
OAuth2Scope:
example:
default: false
system: false
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
metadataPublish: NO_CLIENTS
optional: false
id: id
consent: IMPLICIT
properties:
consent:
$ref: '#/components/schemas/OAuth2ScopeConsentType'
default:
default: false
description: Indicates if this Scope is a default scope
type: boolean
description:
description: Description of the Scope
type: string
displayName:
description: Name of the end user displayed in a consent dialog
type: string
id:
description: Scope object ID
readOnly: true
type: string
metadataPublish:
$ref: '#/components/schemas/OAuth2ScopeMetadataPublish'
name:
description: Scope name
type: string
optional:
default: false
description: "Indicates whether the Scope is optional. When set to `true`,\
\ the user can skip consent for the scope."
type: boolean
system:
default: false
description: Indicates if Okta created the Scope
type: boolean
_links:
$ref: '#/components/schemas/LinksSelf'
required:
- name
type: object
OAuth2ScopeConsentGrant:
description: Grant object that represents an app consent scope grant
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
scopeId: okta.users.read
clientId: oag3ih1zrm1cBFOiq0h6
createdBy:
id: 00u5t60iloOHN9pBi0h7
type: User
_embedded:
scope:
id: okta.users.read
_links:
app: ""
authorizationServer: ""
scope: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
client: ""
user: ""
created: 2017-03-28T01:11:10Z
id: oag3ih1zrm1cBFOiq0h6
source: ADMIN
userId: 00u5t60iloOHN9pBi0h7
issuer: https://my_test_okta_org.oktapreview.com
status: ACTIVE
properties:
clientId:
description: Client ID of the app integration
example: oag3ih1zrm1cBFOiq0h6
readOnly: true
type: string
created:
description: Timestamp when the object was created
example: 2017-03-28T01:11:10Z
format: date-time
readOnly: true
type: string
createdBy:
$ref: '#/components/schemas/OAuth2Actor'
id:
description: ID of the Grant object
example: oag3ih1zrm1cBFOiq0h6
readOnly: true
type: string
issuer:
description: The issuer of your org authorization server. This is typically
your Okta domain.
example: https://my_test_okta_org.oktapreview.com
type: string
lastUpdated:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
scopeId:
description: "The name of the [Okta scope](https://developer.okta.com/docs/api/oauth2/#oauth-20-scopes)\
\ for which consent is granted"
example: okta.users.read
type: string
source:
$ref: '#/components/schemas/OAuth2ScopeConsentGrantSource'
status:
$ref: '#/components/schemas/GrantOrTokenStatus'
userId:
description: User ID that granted consent (if `source` is `END_USER`)
example: 00u5t60iloOHN9pBi0h7
readOnly: true
type: string
_embedded:
$ref: '#/components/schemas/OAuth2ScopeConsentGrant__embedded'
_links:
$ref: '#/components/schemas/OAuth2ScopeConsentGrant__links'
required:
- issuer
- scopeId
type: object
OAuth2ScopeConsentGrantSource:
description: User type source that granted consent
enum:
- ADMIN
- END_USER
example: ADMIN
readOnly: true
type: string
OAuth2ScopeConsentType:
default: IMPLICIT
description: Indicates whether a consent dialog is needed for the Scope
enum:
- FLEXIBLE
- IMPLICIT
- REQUIRED
type: string
OAuth2ScopeMetadataPublish:
default: NO_CLIENTS
description: Indicates whether the Scope is included in the metadata
enum:
- ALL_CLIENTS
- NO_CLIENTS
type: string
OAuth2ScopesMediationPolicyRuleCondition:
description: Array of scopes that the condition includes
example:
include:
- include
- include
properties:
include:
items:
type: string
type: array
type: object
OAuth2Token:
properties:
clientId:
description: Client ID
example: 0oabskvc6442nkvQO0h7
readOnly: true
type: string
created:
description: Timestamp when the object was created
example: 2017-03-28T01:11:10Z
format: date-time
readOnly: true
type: string
expiresAt:
description: Expiration time of the OAuth 2.0 Token
format: date-time
readOnly: true
type: string
id:
description: ID of the Token object
readOnly: true
type: string
issuer:
description: The complete URL of the authorization server that issued the
Token
type: string
lastUpdated:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
scopes:
description: Name of scopes attached to the Token
items:
type: string
type: array
status:
$ref: '#/components/schemas/GrantOrTokenStatus'
userId:
type: string
_embedded:
additionalProperties:
properties: {}
type: object
description: Embedded resources related to the object if the `expand` query
parameter is specified
readOnly: true
type: object
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
OAuthApplicationCredentials:
allOf:
- $ref: '#/components/schemas/ApplicationCredentials'
- properties:
oauthClient:
$ref: '#/components/schemas/ApplicationCredentialsOAuthClient'
type: object
OAuthAuthorizationEndpoint:
description: "Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18)"
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
url:
description: URL of the IdP Authorization Server (AS) authorization endpoint
example: https://idp.example.com/authorize
type: string
type: object
OAuthClientSecretLinks:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of an application using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources\
\ and lifecycle operations."
example:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
delete:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
activate:
$ref: '#/components/schemas/HrefObjectActivateLink'
deactivate:
$ref: '#/components/schemas/HrefObjectDeactivateLink'
delete:
$ref: '#/components/schemas/HrefObjectDeleteLink'
readOnly: true
OAuthCredentials:
description: "Client authentication credentials for an [OAuth 2.0 Authorization\
\ Server](https://tools.ietf.org/html/rfc6749#section-2.3)"
properties:
client:
$ref: '#/components/schemas/OAuthCredentialsClient'
signing:
$ref: '#/components/schemas/AppleClientSigning'
type: object
OAuthCredentialsClient:
description: |-
OAuth 2.0 and OpenID Connect Client object
> **Note:** You must complete client registration with the IdP Authorization Server for your Okta IdP instance to obtain client credentials.
properties:
client_id:
description: "The [Unique identifier](https://tools.ietf.org/html/rfc6749#section-2.2)\
\ issued by the AS for the Okta IdP instance"
example: your-client-id
maxLength: 1024
type: string
client_secret:
description: "The [Client secret](https://tools.ietf.org/html/rfc6749#section-2.3.1)\
\ issued by the AS for the Okta IdP instance"
example: your-client-secret
maxLength: 1024
type: string
pkce_required:
description: Require Proof Key for Code Exchange (PKCE) for additional verification
type: boolean
token_endpoint_auth_method:
description: Client authentication methods supported by the token endpoint
enum:
- private_key_jwt
type: string
type: object
OAuthEndpointAuthenticationMethod:
default: client_secret_basic
description: Requested authentication method for the token endpoint
enum:
- client_secret_basic
- client_secret_jwt
- client_secret_post
- none
- private_key_jwt
type: string
OAuthEndpoints:
description: |-
The `OAUTH2` and `OIDC` protocols support the `authorization` and `token` endpoints. Also, the `OIDC` protocol supports the `userInfo` and `jwks` endpoints.
The IdP Authorization Server (AS) endpoints are currently defined as part of the [IdP provider]((https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request)) and are read-only.
properties:
authorization:
$ref: '#/components/schemas/OAuthAuthorizationEndpoint'
jwks:
$ref: '#/components/schemas/OidcJwksEndpoint'
token:
$ref: '#/components/schemas/OAuthTokenEndpoint'
userInfo:
$ref: '#/components/schemas/OidcUserInfoEndpoint'
type: object
OAuthGrantType:
description: Array of OAuth 2.0 grant type strings
enum:
- authorization_code
- client_credentials
- implicit
- interaction_code
- password
- refresh_token
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:jwt-bearer
- urn:ietf:params:oauth:grant-type:saml2-bearer
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:openid:params:grant-type:ciba
type: string
OAuthMetadata:
properties:
authorization_endpoint:
description: URL of the authorization server's authorization endpoint.
type: string
backchannel_authentication_request_signing_alg_values_supported:
description: <div class="x-lifecycle-container"><x-lifecycle class="lea"></x-lifecycle>
<x-lifecycle class="oie"></x-lifecycle></div>A list of signing algorithms
that this authorization server supports for signed requests.
items:
$ref: '#/components/schemas/SigningAlgorithm'
type: array
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
backchannel_token_delivery_modes_supported:
description: <div class="x-lifecycle-container"><x-lifecycle class="lea"></x-lifecycle>
<x-lifecycle class="oie"></x-lifecycle></div>The delivery modes that this
authorization server supports for Client-Initiated Backchannel Authentication.
items:
$ref: '#/components/schemas/TokenDeliveryMode'
type: array
x-okta-lifecycle:
lifecycle: LIMITED_GA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
claims_supported:
description: A list of the claims supported by this authorization server.
items:
$ref: '#/components/schemas/Claim'
type: array
code_challenge_methods_supported:
description: A list of PKCE code challenge methods supported by this authorization
server.
items:
$ref: '#/components/schemas/CodeChallengeMethod'
type: array
device_authorization_endpoint:
type: string
dpop_signing_alg_values_supported:
description: A list of signing algorithms supported by this authorization
server for Demonstrating Proof-of-Possession (DPoP) JWTs.
items:
enum:
- ES256
- ES384
- ES512
- RS256
- RS384
- RS512
type: string
type: array
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
end_session_endpoint:
description: URL of the authorization server's logout endpoint.
type: string
grant_types_supported:
description: A list of the grant type values that this authorization server
supports.
items:
$ref: '#/components/schemas/GrantType'
type: array
introspection_endpoint:
description: URL of the authorization server's introspection endpoint.
type: string
introspection_endpoint_auth_methods_supported:
description: A list of client authentication methods supported by this introspection
endpoint.
items:
$ref: '#/components/schemas/EndpointAuthMethod'
type: array
issuer:
description: "The authorization server's issuer identifier. In the context\
\ of this document, this is your authorization server's base URL. This\
\ becomes the `iss` claim in an access token."
type: string
jwks_uri:
description: URL of the authorization server's JSON Web Key Set document.
type: string
pushed_authorization_request_endpoint:
type: string
registration_endpoint:
description: URL of the authorization server's JSON Web Key Set document.
type: string
request_object_signing_alg_values_supported:
description: A list of signing algorithms that this authorization server
supports for signed requests.
items:
$ref: '#/components/schemas/SigningAlgorithm'
type: array
request_parameter_supported:
description: Indicates if Request Parameters are supported by this authorization
server.
type: boolean
response_modes_supported:
description: A list of the `response_mode` values that this authorization
server supports. More information here.
items:
$ref: '#/components/schemas/ResponseMode'
type: array
response_types_supported:
description: "A list of the `response_type` values that this authorization\
\ server supports. Can be a combination of `code`, `token`, and `id_token`."
items:
$ref: '#/components/schemas/ResponseTypesSupported'
type: array
revocation_endpoint:
description: URL of the authorization server's revocation endpoint.
type: string
revocation_endpoint_auth_methods_supported:
description: A list of client authentication methods supported by this revocation
endpoint.
items:
$ref: '#/components/schemas/EndpointAuthMethod'
type: array
scopes_supported:
description: A list of the scope values that this authorization server supports.
items:
$ref: '#/components/schemas/Scope'
type: array
subject_types_supported:
description: "A list of the Subject Identifier types that this authorization\
\ server supports. Valid types include `pairwise` and `public`, but only\
\ `public` is currently supported. See the [Subject Identifier Types](https://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes)\
\ section in the OpenID Connect specification."
items:
$ref: '#/components/schemas/SubjectType'
type: array
token_endpoint:
description: URL of the authorization server's token endpoint.
type: string
token_endpoint_auth_methods_supported:
description: A list of client authentication methods supported by this token
endpoint.
items:
$ref: '#/components/schemas/EndpointAuthMethod'
type: array
type: object
OAuthProvisioningEnabledApp:
description: Application name for the provisioning connection
enum:
- google
- office365
- slack
- zoomus
type: string
OAuthResponseType:
description: Array of OAuth 2.0 response type strings
enum:
- code
- id_token
- token
type: string
OAuthTokenEndpoint:
description: "Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18)"
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
url:
description: URL of the IdP Authorization Server (AS) token endpoint
example: https://idp.example.com/token
type: string
type: object
OINApplication:
properties:
accessibility:
$ref: '#/components/schemas/ApplicationAccessibility'
credentials:
$ref: '#/components/schemas/SchemeApplicationCredentials'
label:
description: User-defined display name for app
type: string
licensing:
$ref: '#/components/schemas/ApplicationLicensing'
name:
description: The key name for the OIN app definition
type: string
profile:
additionalProperties:
properties: {}
type: object
description: Contains any valid JSON schema for specifying properties that
can be referenced from a request (only available to OAuth 2.0 client apps)
type: object
signOnMode:
description: Authentication mode for the app
type: string
status:
$ref: '#/components/schemas/ApplicationLifecycleStatus'
visibility:
$ref: '#/components/schemas/ApplicationVisibility'
type: object
OINSaml11ApplicationSettingsSignOn:
description: Contains SAML 1.1 sign-on mode attributes
properties:
audienceOverride:
description: "Audience override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
defaultRelayState:
description: Identifies a specific application resource in an IdP-initiated
SSO scenario
type: string
recipientOverride:
description: "Recipient override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
ssoAcsUrlOverride:
description: "Assertion Consumer Service (ACS) URL override for CASB configuration.\
\ See [CASB config guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
title: SAML 1.1 settings
type: object
OINSaml20ApplicationSettingsSignOn:
description: |-
Contains SAML 2.0 sign-on mode attributes.
> **Note:** Set `destinationOverride` to configure any other SAML 2.0 attributes in this section.
properties:
audienceOverride:
description: "Audience override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
configuredAttributeStatements:
items:
$ref: '#/components/schemas/SamlAttributeStatement'
type: array
defaultRelayState:
description: Identifies a specific application resource in an IdP-initiated
SSO scenario
type: string
destinationOverride:
description: "Destination override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
recipientOverride:
description: "Recipient override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
samlAssertionLifetimeSeconds:
description: Determines the SAML app session lifetimes with Okta
example: 3600
type: integer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
ssoAcsUrlOverride:
description: "Assertion Consumer Service (ACS) URL override for CASB configuration.\
\ See [CASB config guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
title: SAML 2.0 settings
type: object
OSVersion:
description: |
Specifies the OS requirement for the policy.
There are two types of OS requirements:
* **Static**: A specific OS version requirement that doesn't change until you update the policy. A static OS requirement is specified with the `osVersion.minimum` property.
* **Dynamic**: An OS version requirement that is relative to the latest major OS release and security patch. A dynamic OS requirement is specified with the `osVersion.dynamicVersionRequirement` property.
> **Note:** Dynamic OS requirements are available only if the **Dynamic OS version compliance** [self-service EA](/openapi/okta-management/guides/release-lifecycle/#early-access-ea) feature is enabled. You can't specify both `osVersion.minimum` and `osVersion.dynamicVersionRequirement` properties at the same time.
properties:
dynamicVersionRequirement:
$ref: '#/components/schemas/OSVersion_dynamicVersionRequirement'
minimum:
description: "The device version must be equal to or newer than the specified\
\ version string (maximum of three components for iOS and macOS, and maximum\
\ of four components for Android)"
example: 12.4.5
type: string
type: object
OSVersionConstraint:
properties:
dynamicVersionRequirement:
$ref: '#/components/schemas/OSVersionConstraint_dynamicVersionRequirement'
majorVersionConstraint:
description: Indicates the Windows major version
enum:
- WINDOWS_11
- WINDOWS_10
type: string
x-enumDescriptions:
WINDOWS_11: The device is on Windows 11
WINDOWS_10: The device is on Windows 10 or an older Windows version
minimum:
description: The Windows device version must be equal to or newer than the
specified version
example: 12.4.5.9
type: string
required:
- majorVersionConstraint
type: object
OSVersionFourComponents:
description: Current version of the operating system (maximum of four components
in the versioning scheme)
properties:
minimum:
example: 12.4.5.9
type: string
type: object
OSVersionThreeComponents:
description: Current version of the operating system (maximum of three components
in the versioning scheme)
properties:
minimum:
example: 12.4.5
type: string
type: object
Office365Application:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- office365
example: office365
type: string
signOnMode:
enum:
- BROWSER_PLUGIN
- SAML_1_1
example: BROWSER_PLUGIN
type: string
settings:
$ref: '#/components/schemas/Office365ApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for the Microsoft Office 365 app (key name: `office365`)
To create a Microsoft Office 365 app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Office 365 app only supports `BROWSER_PLUGIN` and `SAML_1_1` sign-on modes.
example:
name: office365
label: Sample Office365 App
signOnMode: SAML_1_1
settings:
app:
domain: myintegration.okta365test.net
msftTenant: mycompanyinc
title: Microsoft Office 365
x-tags:
- Application
x-okta-defined-as:
name: office365
Office365ApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/Office365ApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml11ApplicationSettingsSignOn'
required:
- app
Office365ApplicationSettingsApplication:
description: Office365 app instance properties
properties:
domain:
description: The domain for your Office 365 account
type: string
msftTenant:
description: Microsoft tenant name
type: string
required:
- domain
- msftTenant
type: object
Office365ProvisioningSettings:
description: Settings required for the Microsoft Office 365 Provisioning Connection
properties:
adminPassword:
description: Microsoft Office 365 global administrator password
type: string
adminUsername:
description: Microsoft Office 365 global administrator username
type: string
required:
- adminPassword
- adminUsername
title: Microsoft Office 365 provisioning settings
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
OfflineAccessScopeResourceHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scppb56cIl4GvGxy70g3"
type: string
title:
description: Link name
example: offline_access
type: string
type: object
Oidc:
description: OIDC configuration details
properties:
doc:
description: "The URL to your customer-facing instructions for configuring\
\ your OIDC integration. See [Customer configuration document guidelines](https://developer.okta.com/docs/guides/submit-app-prereq/main/#customer-configuration-document-guidelines)."
example: https://example.com/strawberry/help/oidcSetup
format: uri
type: string
initiateLoginUri:
description: The URL to redirect users when they click on your app from
their Okta End-User Dashboard
example: "https://${org.subdomain}.example.com/strawberry/oidc/sp-init"
format: uri
type: string
postLogoutUris:
description: The sign-out redirect URIs for your app. You can send a request
to `/v1/logout` to sign the user out and redirect them to one of these
URIs.
items:
description: "A sign-out redirect URI. You can use the org properties\
\ you defined in the `config` array as variables in your URI. For example:\
\ `https://${org.subdomain}.example.com/strawberry/oidc/logged-out`"
example: "https://${org.subdomain}.example.com/strawberry/oidc/logged-out"
format: uri
type: string
type: array
redirectUris:
description: List of sign-in redirect URIs
items:
description: Sign-in redirect URI
example: "https://${org.subdomain}.example.com/strawberry/oidc/login"
format: uri
type: string
minItems: 1
type: array
required:
- doc
- redirectUris
type: object
OidcAlgorithms:
properties:
request:
$ref: '#/components/schemas/OidcRequestAlgorithm'
type: object
OidcJwksEndpoint:
description: "Endpoint for the JSON Web Key Set (JWKS) document. This document\
\ contains signing keys that are used to validate the signatures from the\
\ provider. For more information on JWKS, see [JSON Web Key](https://tools.ietf.org/html/rfc7517)."
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
url:
description: URL of the endpoint to the JWK Set
example: https://idp.example.com/keys
type: string
type: object
OidcRequestAlgorithm:
description: Algorithm settings used to sign an authorization request
properties:
signature:
$ref: '#/components/schemas/OidcRequestSignatureAlgorithm'
type: object
OidcRequestSignatureAlgorithm:
description: |-
Signature Algorithm settings for signing authorization requests sent to the IdP
> **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`).
properties:
algorithm:
$ref: '#/components/schemas/OidcSigningAlgorithm'
scope:
$ref: '#/components/schemas/ProtocolAlgorithmRequestScope'
type: object
OidcSigningAlgorithm:
enum:
- HS256
- HS384
- HS512
- RS256
- RS384
- RS512
type: string
OidcUserInfoEndpoint:
description: "Endpoint for getting identity information about the User. For\
\ more information on the `/userinfo` endpoint, see [OpenID Connect](https://openid.net/specs/openid-connect-core-1_0.html#UserInfo)."
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
url:
description: URL of the resource server's `/userinfo` endpoint
example: https://idp.example.com/userinfo
type: string
type: object
OktaActiveDirectoryGroupProfile:
description: |-
Profile for a Group that is imported from Active Directory.
The `objectClass` for such groups is `okta:windows_security_principal`.
properties:
description:
description: Description of the Windows Group
example: example.com/West Coast/West Coast Users
type: string
dn:
description: The distinguished name of the Windows Group
example: "CN=West Coast Users,OU=West Coast,DC=example,DC=com"
type: string
externalId:
description: Base-64 encoded GUID (`objectGUID`) of the Windows Group
example: VKzYZ1C+IkSZxIWlrW5ITg==
type: string
name:
description: Name of the Windows Group
example: West Coast Users
type: string
samAccountName:
description: Pre-Windows 2000 name of the Windows Group
example: West Coast Users
type: string
windowsDomainQualifiedName:
description: Fully qualified name of the Windows Group
example: EXAMPLE\\West Coast Users
type: string
type: object
OktaDeviceRiskChangeEvent:
description: The device risk level changed
properties:
current_level:
description: Current risk level of the device
enum:
- low
- medium
- high
- secure
- none
example: low
type: string
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
initiating_entity:
description: The entity that initiated the event
enum:
- admin
- user
- policy
- system
type: string
previous_level:
description: Previous risk level of the device
enum:
- low
- medium
- high
- secure
- none
example: medium
type: string
reason_admin:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_admin'
reason_user:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_user'
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- current_level
- event_timestamp
- previous_level
- subject
type: object
OktaIpChangeEvent:
description: IP changed for the subject's session
properties:
current_ip_address:
description: Current IP address of the subject
example: 123.4.5.6
type: string
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
initiating_entity:
description: The entity that initiated the event
enum:
- admin
- user
- policy
- system
type: string
previous_ip_address:
description: Previous IP address of the subject
example: 123.45.67.8
type: string
reason_admin:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_admin'
reason_user:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_user'
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- current_ip_address
- event_timestamp
- previous_ip_address
- subject
type: object
OktaPersonalAdminFeatureSettings:
description: Defines a list of Okta Personal settings that can be enabled or
disabled for the org
properties:
enableEnduserEntryPoints:
description: Allow entry points for an Okta Personal account in a Workforce
org
type: boolean
enableExportApps:
description: Allow users to migrate apps from a Workforce account to an
Okta Personal account
type: boolean
type: object
OktaSignOnPolicy:
allOf:
- $ref: '#/components/schemas/Policy'
- properties:
conditions:
$ref: '#/components/schemas/OktaSignOnPolicyConditions'
type: object
OktaSignOnPolicyConditions:
allOf:
- $ref: '#/components/schemas/PolicyRuleConditions'
- properties:
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
type: object
OktaSignOnPolicyFactorPromptMode:
description: |
Indicates if the User should be challenged for a second factor (MFA) based on the device being used, a Factor session lifetime, or on every sign-in attempt
**Note:** Required only if `requireFactor` is set to `true`.
enum:
- ALWAYS
- DEVICE
- SESSION
type: string
OktaSignOnPolicyRule:
allOf:
- $ref: '#/components/schemas/PolicyRule'
- properties:
actions:
$ref: '#/components/schemas/OktaSignOnPolicyRuleActions'
conditions:
$ref: '#/components/schemas/OktaSignOnPolicyRuleConditions'
type: object
OktaSignOnPolicyRuleActions:
allOf:
- $ref: '#/components/schemas/PolicyRuleActions'
- properties:
signon:
$ref: '#/components/schemas/OktaSignOnPolicyRuleSignonActions'
type: object
OktaSignOnPolicyRuleConditions:
allOf:
- properties:
authContext:
$ref: '#/components/schemas/PolicyRuleAuthContextCondition'
network:
$ref: '#/components/schemas/PolicyNetworkCondition'
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
identityProvider:
$ref: '#/components/schemas/IdentityProviderPolicyRuleCondition'
type: object
OktaSignOnPolicyRuleSignonActions:
properties:
access:
enum:
- ALLOW
- DENY
type: string
factorLifetime:
description: |
Interval of time that must elapse before the User is challenged for MFA, if the Factor prompt mode is set to `SESSION`
**Note:** Required only if `requireFactor` is `true`.
type: integer
factorPromptMode:
$ref: '#/components/schemas/OktaSignOnPolicyFactorPromptMode'
primaryFactor:
$ref: '#/components/schemas/OktaSignOnPolicyRuleSignonPrimaryFactor'
rememberDeviceByDefault:
default: false
description: Indicates if Okta should automatically remember the device
type: boolean
requireFactor:
default: false
description: Indicates if multifactor authentication is required
type: boolean
session:
$ref: '#/components/schemas/OktaSignOnPolicyRuleSignonSessionActions'
type: object
OktaSignOnPolicyRuleSignonPrimaryFactor:
description: "<x-lifecycle class=\"oie\"></x-lifecycle> Indicates the primary\
\ factor used to establish a session for the org. Supported values: `PASSWORD_IDP_ANY_FACTOR`\
\ (users can use any factor required by the app authentication policy to establish\
\ a session), `PASSWORD_IDP` (users must always use a password to establish\
\ a session). \n\n**Note:** Required only if `access` is set to `ALLOW`."
enum:
- PASSWORD_IDP
- PASSWORD_IDP_ANY_FACTOR
type: string
OktaSignOnPolicyRuleSignonSessionActions:
description: Properties governing the User's session lifetime
properties:
maxSessionIdleMinutes:
default: 120
description: Maximum number of minutes that a User session can be idle before
the session is ended
type: integer
maxSessionLifetimeMinutes:
default: 0
description: Maximum number of minutes from User sign in that a user's session
is active. Set this to force Users to sign in again after the number of
specified minutes. Disable by setting to `0`. This property is read-only
for the default rule of the default global session policy.
type: integer
usePersistentCookie:
default: false
description: "If set to `false`, user session cookies only last the length\
\ of a browser session. If set to `true`, user session cookies last across\
\ browser sessions. This setting doesn't impact administrators who can\
\ never have persistent session cookies. This property is read-only for\
\ the default rule of the default global session policy."
type: boolean
type: object
OktaUserGroupProfile:
description: |-
Profile for any Group that is not imported from Active Directory. Specifies the standard
and custom profile properties for a Group.
The `objectClass` for these groups is `okta:user_group`.
example:
name: West Coast Users
description: All Users West of The Rockies
properties:
description:
description: Description of the Group
example: All Users West of The Rockies
type: string
name:
description: Name of the Group
example: West Coast Users
type: string
type: object
x-okta-extensible: true
OktaUserRiskChangeEvent:
description: The user risk level changed
properties:
current_level:
description: Current risk level of the user
enum:
- low
- medium
- high
- secure
- none
example: low
type: string
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
initiating_entity:
description: The entity that initiated the event
enum:
- admin
- user
- policy
- system
type: string
previous_level:
description: Previous risk level of the user
enum:
- low
- medium
- high
- secure
- none
example: medium
type: string
reason_admin:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_admin'
reason_user:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent_reason_user'
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- current_level
- event_timestamp
- previous_level
- subject
type: object
OpenIdConnectApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/OAuthApplicationCredentials'
name:
description: '`oidc_client` is the key name for an OAuth 2.0 client app
instance'
type: string
settings:
$ref: '#/components/schemas/OpenIdConnectApplicationSettings'
required:
- credentials
- name
- settings
type: object
x-okta-defined-as:
name: oidc_client
OpenIdConnectApplicationConsentMethod:
default: TRUSTED
description: |
Indicates whether user consent is required or implicit.
A consent dialog appears for the end user depending on the values of three elements:
* [prompt](/openapi/okta-oauth/oauth/tag/OrgAS/#tag/OrgAS/operation/authorize!in=query&path=prompt&t=request): A query parameter that is used in requests to `/authorize`
* `consent_method` (this property)
* [consent](/openapi/okta-management/management/tag/AuthorizationServerScopes/#tag/AuthorizationServerScopes/operation/createOAuth2Scope!path=consent&t=request): A [Scope](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/AuthorizationServerScopes/) property that allows you to enable or disable user consent for an individual scope
| `prompt` | `consent_method` | `consent` | Result
| ---------- | ----------- | ---------- | ----------- |
| CONSENT | TRUSTED or REQUIRED | REQUIRED | Prompted |
| CONSENT | TRUSTED or REQUIRED | FLEXIBLE | Prompted |
| CONSENT | TRUSTED | IMPLICIT | Not prompted |
| NONE | TRUSTED | FLEXIBLE, IMPLICIT, or REQUIRED | Not prompted |
| NONE | REQUIRED | FLEXIBLE or REQUIRED | Prompted |
| NONE | REQUIRED | IMPLICIT | Not prompted |
> **Notes:**
> * If you request a scope that requires consent while using the `client_credentials` flow, an error is returned because the flow doesn't support user consent.
> * If the `prompt` value is set to `NONE`, but the `consent_method` and the consent values are set to `REQUIRED`, then an error occurs.
> * When a scope is requested during a Client Credentials grant flow and `consent` is set to `FLEXIBLE`, the scope is granted in the access token with no consent prompt. This occurs because there is no user involved in a two-legged OAuth 2.0 [Client Credentials](https://developer.okta.com/docs/guides/implement-grant-type/clientcreds/main/) grant flow.
enum:
- REQUIRED
- TRUSTED
type: string
x-enumDescriptions:
TRUSTED: "The client is fully trusted (for example, a first-party app). The\
\ default consent method for app instances created with a [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)\
\ request"
REQUIRED: "The client requires consent (for example, a third-party app). The\
\ default consent method for app instances created with a [Create a Client\
\ Application](/openapi/okta-oauth/oauth/tag/Client/#tag/Client/operation/createClient)\
\ request"
OpenIdConnectApplicationIdpInitiatedLogin:
description: The type of IdP-initiated sign-in flow that the client supports
properties:
default_scope:
description: The scopes to use for the request when `mode` is `OKTA`
items:
type: string
type: array
mode:
description: |
The mode to use for the IdP-initiated sign-in flow. For `OKTA` or `SPEC` modes, the client must have an `initiate_login_uri` registered.
> **Note:** For web and SPA apps, if the mode is `SPEC` or `OKTA`, you must set `grant_types` to `authorization_code`, `implicit`, or `interaction_code`.
enum:
- DISABLED
- SPEC
- OKTA
type: string
x-enumDescriptions:
DISABLED: The client doesn't support the IdP-initiated sign-in flow.
SPEC: The client is redirected to the Relying Party's `initiate_login_uri`.
OKTA: Tokens are directly sent to the Relying Party. This corresponds
to the **Okta Simplified** option in the Admin Console.
required:
- mode
type: object
OpenIdConnectApplicationIssuerMode:
description: Indicates whether the Okta authorization server uses the original
Okta org domain URL or a custom domain URL as the issuer of the ID token for
this client
enum:
- CUSTOM_URL
- DYNAMIC
- ORG_URL
type: string
x-enumDescriptions:
CUSTOM_URL: The issuer is returned in the appropriate OIDC token response.
This is the default `issuer_mode` when you configured a custom domain for
your org.
DYNAMIC: A request for the ID token made from the custom domain has the custom
URL as the issuer. A request for the ID token made from an Okta org has
the Org URL as the issuer. You can only set `issuer_mode` as DYNAMIC if
the Dynamic Issuer Mode feature is enabled. Contact Okta Support to enable
this feature.
ORG_URL: The issuer is returned based on the URL of your Okta organization.
This is useful when you are using Okta’s default domain and do not have
a custom domain configured.
OpenIdConnectApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
oauthClient:
$ref: '#/components/schemas/OpenIdConnectApplicationSettingsClient'
type: object
OpenIdConnectApplicationSettingsClient:
properties:
application_type:
$ref: '#/components/schemas/OpenIdConnectApplicationType'
backchannel_authentication_request_signing_alg:
description: |
The signing algorithm for Client-Initiated Backchannel Authentication (CIBA) signed requests using JWT. If this value isn't set and a JWT-signed request is sent, the request fails.
> **Note:** This property appears for clients with `urn:openid:params:grant-type:ciba` defined as one of the `grant_types`.
enum:
- HS256
- HS384
- HS512
- RS256
- RS384
- RS512
- ES256
- ES384
- ES512
type: string
backchannel_custom_authenticator_id:
description: |
The ID of the custom authenticator that authenticates the user
> **Note:** This property appears for clients with `urn:openid:params:grant-type:ciba` defined as one of the `grant_types`.
maxLength: 20
minLength: 20
type: string
backchannel_token_delivery_mode:
description: |
The delivery mode for Client-Initiated Backchannel Authentication (CIBA). Currently, only `poll` is supported.
> **Note:** This property appears for clients with `urn:openid:params:grant-type:ciba` defined as one of the `grant_types`.
enum:
- poll
- ping
- push
type: string
client_uri:
description: URL string of a web page providing information about the client
maxLength: 1024
type: string
consent_method:
$ref: '#/components/schemas/OpenIdConnectApplicationConsentMethod'
dpop_bound_access_tokens:
default: false
description: |
Indicates that the client application uses Demonstrating Proof-of-Possession (DPoP) for token requests. If `true`, the authorization server rejects token requests from this client that don't contain the DPoP header.
> **Note:** If `dpop_bound_access_tokens` is true, then `client_credentials` and `implicit` aren't allowed in `grant_types`.
type: boolean
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
frontchannel_logout_session_required:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle>
<x-lifecycle class="oie"></x-lifecycle></div>Determines whether Okta sends
`sid` and `iss` in the logout request
type: boolean
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
frontchannel_logout_uri:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle>
<x-lifecycle class="oie"></x-lifecycle></div>URL where Okta sends the
logout request
maxLength: 1024
type: string
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
grant_types:
items:
$ref: '#/components/schemas/OAuthGrantType'
type: array
idp_initiated_login:
$ref: '#/components/schemas/OpenIdConnectApplicationIdpInitiatedLogin'
initiate_login_uri:
description: URL string that a third party can use to initiate the sign-in
flow by the client
type: string
issuer_mode:
$ref: '#/components/schemas/OpenIdConnectApplicationIssuerMode'
jwks:
$ref: '#/components/schemas/OpenIdConnectApplicationSettingsClientKeys'
jwks_uri:
description: URL string that references a JSON Web Key Set for validating
JWTs presented to Okta
type: string
logo_uri:
description: The URL string that references a logo for the client. This
logo appears on the client tile in the End-User Dashboard. It also appears
on the client consent dialog during the client consent flow.
maxLength: 1024
type: string
participate_slo:
description: |
<div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle> <x-lifecycle class="oie"></x-lifecycle></div>Allows the app to participate in front-channel Single Logout
> **Note:** You can only enable `participate_slo` for `web` and `browser` application types (`application_type`).
type: boolean
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs:
- Okta Identity Engine
policy_uri:
description: URL string of a web page providing the client's policy document
type: string
post_logout_redirect_uris:
description: Array of redirection URI strings for relying party-initiated
logouts
items:
type: string
type: array
redirect_uris:
description: |-
Array of redirection URI strings for use in redirect-based flows.
> **Note:** At least one `redirect_uris` and `response_types` are required for all client types, with exceptions: if the client uses the [Resource Owner Password ](https://tools.ietf.org/html/rfc6749#section-4.3)flow (`grant_types` contains `password`) or [Client Credentials](https://tools.ietf.org/html/rfc6749#section-4.4)flow (`grant_types` contains `client_credentials`), then no `redirect_uris` or `response_types` is necessary. In these cases, you can pass either null or an empty array for these attributes.
items:
type: string
type: array
refresh_token:
$ref: '#/components/schemas/OpenIdConnectApplicationSettingsRefreshToken'
request_object_signing_alg:
description: The type of JSON Web Key Set (JWKS) algorithm that must be
used for signing request objects
enum:
- HS256
- HS384
- HS512
- RS256
- RS384
- RS512
- ES256
- ES384
- ES512
type: string
response_types:
description: Array of OAuth 2.0 response type strings
items:
$ref: '#/components/schemas/OAuthResponseType'
type: array
sector_identifier_uri:
description: "The sector identifier used for pairwise `subject_type`. See\
\ [OIDC Pairwise Identifier Algorithm](https://openid.net/specs/openid-connect-messages-1_0-20.html#idtype.pairwise.alg)"
maxLength: 1024
type: string
subject_type:
description: Type of the subject
enum:
- public
- pairwise
type: string
tos_uri:
description: URL string of a web page providing the client's terms of service
document
type: string
wildcard_redirect:
description: Indicates if the client is allowed to use wildcard matching
of `redirect_uris`
enum:
- DISABLED
- SUBDOMAIN
type: string
x-enumDescriptions:
DISABLED: All redirect URIs must be absolute URIs and not include a fragment
component.
SUBDOMAIN: |
Any configured redirect URIs may contain a single `*` character in the lowest-level domain (for example, `https://redirect-*-domain.example.com/oidc/redirect`) to act as a wildcard.
The wildcard subdomain must have at least one subdomain between it and the top level domain.
The wildcard can match any valid hostname characters, but can't span more than one domain.
For example, if `https://redirect-*-domain.example.com/oidc/redirect` is configured as a redirect URI, then `https://redirect-1-domain.example.com/oidc/redirect` and `https://redirect-sub-domain.example.com/oidc/redirect` match, but `https://redirect-1.sub-domain.example.com/oidc/redirect` doesn't match.
Only the `https` URI scheme can use wildcard redirect URIs.
> **Note:** The use of wildcard subdomains is discouraged as an insecure practice, since it may allow malicious actors to have tokens or authorization codes sent to unexpected or attacker-controlled pages. Exercise caution if you decide to include a wildcard redirect URI in your configuration.
required:
- grant_types
type: object
OpenIdConnectApplicationSettingsClientKeys:
description: "A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5)\
\ for validating JWTs presented to Okta"
properties:
keys:
items:
$ref: '#/components/schemas/schemas-JsonWebKey'
type: array
type: object
OpenIdConnectApplicationSettingsRefreshToken:
description: |
Refresh token configuration for an OAuth 2.0 client
When you create or update an OAuth 2.0 client, you can configure refresh token rotation by setting the `rotation_type` and `leeway` properties. If you don't set these properties when you create an app integration, the default values are used.
When you update an app integration, your previously configured values are used.
properties:
leeway:
default: 30
description: |
The leeway, in seconds, allowed for the OAuth 2.0 client.
After the refresh token is rotated, the previous token remains valid for the specified period of time so clients can get the new token.
> **Note:** A leeway of 0 doesn't necessarily mean that the previous token is immediately invalidated. The previous token is invalidated after the new token is generated and returned in the response.
example: 20
maximum: 60
minimum: 0
type: integer
rotation_type:
$ref: '#/components/schemas/OpenIdConnectRefreshTokenRotationType'
required:
- rotation_type
type: object
OpenIdConnectApplicationType:
description: "The type of client app \nSpecific `grant_types` are valid\
\ for each `application_type`. See [Create a Client Application](/openapi/okta-oauth/oauth/tag/Client/#tag/Client/operation/createClient)."
enum:
- browser
- native
- service
- web
type: string
x-enumDescriptions:
browser: Single-Page app (SPA)
native: Native app
service: API service app
web: Web app
OpenIdConnectRefreshTokenRotationType:
description: The refresh token rotation mode for the OAuth 2.0 client
enum:
- ROTATE
- STATIC
example: STATIC
type: string
x-enumDescriptions:
ROTATE: The default rotation type for single-page apps (SPAs)
STATIC: "The default rotation type for all clients, except SPAs"
OperationRequest:
example:
assignmentId: assignmentId
properties:
assignmentId:
type: string
type: object
OperationResponse:
example:
realmId: realmId
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
realmName: realmName
started: 2000-01-23T04:56:07.000+00:00
completed: 2000-01-23T04:56:07.000+00:00
id: id
type: type
assignmentOperation:
configuration:
name: name
id: id
conditions:
expression:
value: value
profileSourceId: profileSourceId
actions:
assignUserToRealm:
realmId: realmId
numUserMoved: 0.8008281904610115
status: COMPLETED
properties:
assignmentOperation:
$ref: '#/components/schemas/OperationResponse_assignmentOperation'
completed:
format: date-time
readOnly: true
type: string
created:
format: date-time
readOnly: true
type: string
id:
readOnly: true
type: string
numUserMoved:
readOnly: true
type: number
realmId:
readOnly: true
type: string
realmName:
readOnly: true
type: string
started:
format: date-time
readOnly: true
type: string
status:
enum:
- COMPLETED
- SCHEDULED
- IN_PROGRESS
- FAILED
readOnly: true
type: string
type:
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
OperationalStatus:
description: Operational status of a given agent
enum:
- DEGRADED
- DISRUPTED
- INACTIVE
- OPERATIONAL
type: string
OptInStatusResponse:
properties:
optInStatus:
enum:
- OPTING_IN
- OPTED_IN
- OPTING_OUT
- OPTED_OUT
type: string
_links:
$ref: '#/components/schemas/OptInStatusResponse__links'
type: object
Org2OrgApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- okta_org2org
example: okta_org2org
type: string
signOnMode:
default: SAML_2_0
enum:
- SAML_2_0
- AUTO_LOGIN
type: string
x-enumDescriptions:
SAML_2_0: Federated Authentication with SAML 2.0 WebSSO
AUTO_LOGIN: Secure Web Authentication (SWA)
settings:
$ref: '#/components/schemas/Org2OrgApplicationSettings'
required:
- label
- name
- settings
description: "Schema for the Okta Org2Org app (key name: `okta_org2org`)\n\n\
To create an Org2Org app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)\
\ request with the following parameters in the request body.\n> **Notes:**\
\ \n> * The Okta Org2Org (`okta_org2org`) app isn't available in Okta Developer\
\ Edition orgs. If you need to test this feature in your Developer Edition\
\ org, contact your Okta account team.\n> * The Okta Org2Org app supports\
\ `SAML_2_0` and `AUTO_LOGIN` sign-on modes.\n"
example:
name: okta_org2org
label: Okta Org2Org
signOnMode: SAML_2_0
settings:
app:
acsUrl: https://example.okta.com/sso/saml2/exampleid
audRestriction: https://www.okta.com/saml2/service-provider/exampleid
baseUrl: https://example.okta.com
title: Org2Org
x-tags:
- Application
x-okta-defined-as:
name: okta_org2org
Org2OrgApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/Org2OrgApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
Org2OrgApplicationSettingsApplication:
description: Org2Org app instance properties
properties:
acsUrl:
description: The Assertion Consumer Service (ACS) URL of the source org
(for `SAML_2_0` sign-on mode)
type: string
audRestriction:
description: The entity ID of the SP (for `SAML_2_0` sign-on mode)
example: https://www.okta.com/saml2/service-provider/exampleid
type: string
baseUrl:
description: The base URL of the target Okta org (for `SAML_2_0` sign-on
mode)
type: string
creationState:
description: Used to track and manage the state of the app's creation or
the provisioning process between two Okta orgs
type: string
preferUsernameOverEmail:
description: Indicates that you don't want to use an email address as the
username
type: boolean
token:
description: An API token from the target org that's used to secure the
connection between the orgs
type: string
tokenEncrypted:
description: Encrypted token to enhance security
type: string
required:
- baseUrl
type: object
OrgAerialConsent:
example:
accountId: accountId
properties:
accountId:
description: The unique ID of the Aerial account
type: string
required:
- accountId
type: object
OrgAerialConsentDetails:
example:
grantedBy: 00u23ej02I2RLFxS5406
accountId: accountId
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
revoke:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
grantedDate: 2024-07-24T16:01:13.000Z
properties:
accountId:
description: The unique ID of the Aerial account
type: string
grantedBy:
description: Principal ID of the user who granted the permission
example: 00u23ej02I2RLFxS5406
type: string
grantedDate:
description: Date when grant was created
example: 2024-07-24T16:01:13.000Z
type: string
_links:
$ref: '#/components/schemas/LinksAerialConsentGranted'
required:
- accountId
type: object
OrgAerialConsentRevoked:
example:
_links:
grant:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
_links:
$ref: '#/components/schemas/LinksAerialConsentRevoked'
type: object
OrgAerialGrantNotFound:
properties:
accountId:
description: The unique ID of the Aerial account
type: string
grantedBy:
description: Principal ID of the user who granted the permission
example: 00u23ej02I2RLFxS5406
type: string
grantedDate:
description: Date when grant was created
example: 2024-07-24T16:01:13.000Z
type: string
_links:
$ref: '#/components/schemas/LinksAerialConsentGranted'
type: object
OrgCAPTCHASettings:
description: ""
example:
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
enabledPages:
- SIGN_IN
- SIGN_IN
captchaId: captchaId
properties:
captchaId:
description: The unique key of the associated CAPTCHA instance
type: string
enabledPages:
description: An array of pages that have CAPTCHA enabled
items:
$ref: '#/components/schemas/enabledPagesType'
type: array
_links:
$ref: '#/components/schemas/OrgCAPTCHASettings__links'
title: OrgCAPTCHASettings
type: object
OrgContactType:
description: Type of contact
enum:
- BILLING
- TECHNICAL
type: string
OrgContactTypeObj:
anyOf:
- $ref: '#/components/schemas/orgBillingContactType'
- $ref: '#/components/schemas/orgTechnicalContactType'
discriminator:
mapping:
BILLING: '#/components/schemas/orgBillingContactType'
TECHNICAL: '#/components/schemas/orgTechnicalContactType'
propertyName: contactType
example:
contactType: BILLING
properties:
contactType:
$ref: '#/components/schemas/OrgContactType'
type: object
OrgContactUser:
example:
_links:
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
userId: userId
properties:
userId:
description: Contact user ID
type: string
_links:
$ref: '#/components/schemas/OrgContactUser__links'
type: object
OrgCreationAdmin:
description: |-
Profile and credential information for the first super admin user of the child Org.
If you plan to configure and manage the Org programmatically, create a system user with a dedicated email address and a strong password.
> **Note:** If you don't provide `credentials`, the super admin user is prompted to set up their credentials when they sign in to the Org for the first time.
example:
credentials:
password:
value: pa$$word
recovery_question:
answer: se7en
question: what is your favourite movie?
profile:
firstName: firstName
lastName: lastName
login: login
email: email
properties:
credentials:
$ref: '#/components/schemas/OrgCreationAdmin_credentials'
profile:
$ref: '#/components/schemas/OrgCreationAdmin_profile'
required:
- profile
type: object
writeOnly: true
OrgOktaCommunicationSetting:
example:
_links:
optOut:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
optIn:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
optOutEmailUsers: true
properties:
optOutEmailUsers:
description: Indicates whether org users receive Okta communication emails
readOnly: true
type: boolean
_links:
$ref: '#/components/schemas/OrgOktaCommunicationSetting__links'
type: object
OrgOktaSupportSetting:
description: Status of Okta Support Settings
enum:
- DISABLED
- ENABLED
type: string
OrgOktaSupportSettingsObj:
example:
_links:
extend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
revoke:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
grant:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
expiration: 2000-01-23T04:56:07.000+00:00
support: DISABLED
properties:
expiration:
description: Expiration of Okta Support
format: date-time
nullable: true
readOnly: true
type: string
support:
$ref: '#/components/schemas/OrgOktaSupportSetting'
_links:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj__links'
type: object
OrgPreferences:
example:
_links:
hideEndUserFooter:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
showEndUserFooter:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
showEndUserFooter: true
properties:
showEndUserFooter:
description: Indicates if the footer is shown on the End-User Dashboard
readOnly: true
type: boolean
_links:
$ref: '#/components/schemas/OrgPreferences__links'
type: object
OrgSetting:
example:
country: country
website: website
supportPhoneNumber: supportPhoneNumber
address2: address2
city: city
_links:
preferences:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
oktaCommunication:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
uploadLogo:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
oktaSupport:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
contacts:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
address1: address1
created: 2000-01-23T04:56:07.000+00:00
companyName: companyName
postalCode: postalCode
expiresAt: 2000-01-23T04:56:07.000+00:00
lastUpdated: 2000-01-23T04:56:07.000+00:00
phoneNumber: phoneNumber
endUserSupportHelpURL: endUserSupportHelpURL
subdomain: subdomain
id: id
state: state
status: ACTIVE
properties:
address1:
description: Primary address of the organization associated with the org
type: string
address2:
description: Secondary address of the organization associated with the org
type: string
city:
description: City of the organization associated with the org
type: string
companyName:
description: Name of org
type: string
country:
description: County of the organization associated with the org
type: string
created:
description: When org was created
format: date-time
readOnly: true
type: string
endUserSupportHelpURL:
description: Support link of org
type: string
expiresAt:
description: Expiration of org
format: date-time
readOnly: true
type: string
id:
description: Org ID
readOnly: true
type: string
lastUpdated:
description: When org was last updated
format: date-time
readOnly: true
type: string
phoneNumber:
description: Phone number of the organization associated with the org
type: string
postalCode:
description: Postal code of the organization associated with the org
type: string
state:
description: State of the organization associated with the org
type: string
status:
description: Status of org
enum:
- ACTIVE
- INACTIVE
readOnly: true
type: string
subdomain:
description: Subdomain of org
readOnly: true
type: string
supportPhoneNumber:
description: Support help phone of the organization associated with the
org
type: string
website:
description: Website of the organization associated with the org
type: string
_links:
$ref: '#/components/schemas/orgGeneralSettingLinks'
type: object
OtpProtocol:
description: The protocol used
enum:
- SYMANTEC
- TOTP
- YUBICO
type: string
OtpTotpAlgorithm:
description: HMAC algorithm
enum:
- HMacSHA1
- HMacSHA256
- HMacSHA512
type: string
OtpTotpEncoding:
description: The shared secret encoding
enum:
- base32
- base64
- hexadecimal
type: string
OtpTotpPassCodeLength:
description: Number of digits in an OTP value
maximum: 10
minimum: 6
multipleOf: 2
type: integer
OtpTotpTimeIntervalInSeconds:
description: Time interval for TOTP in seconds
type: integer
PageRoot:
example:
_embedded:
preview:
pageContent: pageContent
default:
pageContent: pageContent
customized:
pageContent: pageContent
previewUrl: https://openapi-generator.tech
customizedUrl: https://openapi-generator.tech
_links:
preview:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
default:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
customized:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
_embedded:
$ref: '#/components/schemas/PageRoot__embedded'
_links:
$ref: '#/components/schemas/PageRoot__links'
type: object
Parameters:
description: Attributes used for processing AD Group membership update
example:
values:
- values
- values
action: ADD
attribute: attribute
properties:
action:
description: The update action to take
enum:
- ADD
- REMOVE
type: string
x-enumDescriptions:
ADD: Add to the membership of the group
REMOVE: Remove from the membership of the group
attribute:
description: The attribute that tracks group memberships in AD. This should
be `member` for AD.
type: string
values:
description: List of user IDs whose group memberships to update
items:
description: ID of an existing user
type: string
type: array
type: object
PasswordCredential:
description: "Specifies a password for a user.\n\nWhen a User has a valid password,\
\ imported hashed password, or password hook, and a response object contains\n\
a password credential, then the password object is a bare object without the\
\ value property defined (for example, `password: {}`). This \nindicates that\
\ a password value exists. You can modify password policy requirements in\
\ the Admin Console by editing the Password\nauthenticator: **Security**\
\ > **Authenticators** > **Password** (or for Okta Classic orgs, use **Security**\
\ > **Authentication** > **Password**).\n\nFor information on defaults and\
\ configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password)\
\ in the help documentation."
example:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
properties:
hash:
$ref: '#/components/schemas/PasswordCredentialHash'
hook:
$ref: '#/components/schemas/PasswordCredentialHook'
value:
description: Specifies the password for a user. The Password Policy validates
this password.
example: pa$$word
format: password
type: string
writeOnly: true
type: object
PasswordCredentialHash:
description: |-
Specifies a hashed password to import into Okta. This allows an existing password to be imported into Okta directly
from some other store. Okta supports the BCRYPT, SHA-512, SHA-256, SHA-1, MD5, and PBKDF2 hash functions for password import.
A hashed password may be specified in a Password object when creating or updating a user, but not for other operations.
See [Create User with Imported Hashed Password](https://developer.okta.com/docs/reference/api/users/#create-user-with-imported-hashed-password)
for information on using this object when creating a user. When updating a User with a hashed password, the User must be in the `STAGED` status.
example:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
properties:
algorithm:
$ref: '#/components/schemas/PasswordCredentialHashAlgorithm'
digestAlgorithm:
$ref: '#/components/schemas/DigestAlgorithm'
iterationCount:
description: The number of iterations used when hashing passwords using
PBKDF2. Must be >= 4096. Only required for PBKDF2 algorithm.
type: integer
keySize:
description: Size of the derived key in bytes. Only required for PBKDF2
algorithm.
type: integer
salt:
description: |-
Only required for salted hashes. For BCRYPT, this specifies Radix-64 as the encoded salt used to generate the hash,
which must be 22 characters long. For other salted hashes, this specifies the Base64-encoded salt used to
generate the hash.
type: string
saltOrder:
description: Specifies whether salt was pre- or postfixed to the password
before hashing. Only required for salted algorithms.
type: string
value:
description: |-
For SHA-512, SHA-256, SHA-1, MD5, and PBKDF2, this is the actual base64-encoded hash of the password (and salt, if used).
This is the Base64-encoded `value` of the SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest that was computed by either pre-fixing or post-fixing
the `salt` to the `password`, depending on the `saltOrder`. If a `salt` was not used in the `source` system, then this should just be
the Base64-encoded `value` of the password's SHA-512/SHA-256/SHA-1/MD5/PBKDF2 digest. For BCRYPT, this is the actual Radix-64 encoded hashed password.
type: string
workFactor:
description: Governs the strength of the hash and the time required to compute
it. Only required for BCRYPT algorithm.
maximum: 20
minimum: 1
type: integer
type: object
PasswordCredentialHashAlgorithm:
description: "The algorithm used to generate the hash using the password (and\
\ salt, when applicable)."
enum:
- BCRYPT
- MD5
- PBKDF2
- SHA-1
- SHA-256
- SHA-512
type: string
PasswordCredentialHook:
description: "Specify a [password import inline hook](/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook)\
\ to trigger verification of the User's password the first time the User signs\
\ in. This allows an existing password to be imported into Okta directly from\
\ some other store."
example:
type: type
properties:
type:
description: "The type of password inline hook. Currently, must be set to\
\ default."
type: string
type: object
PasswordDictionary:
description: Weak password dictionary lookup settings
properties:
common:
$ref: '#/components/schemas/PasswordDictionaryCommon'
type: object
PasswordDictionaryCommon:
description: Lookup settings for commonly used passwords
properties:
exclude:
default: false
description: Indicates whether to check passwords against the common password
dictionary
type: boolean
type: object
PasswordExpirationPolicyRuleCondition:
properties:
number:
type: integer
unit:
type: string
type: object
PasswordImportRequest:
properties:
data:
$ref: '#/components/schemas/PasswordImportRequestData'
eventType:
description: The type of inline hook. The password import inline hook type
is `com.okta.user.credential.password.import`.
type: string
source:
description: The ID and URL of the password import inline hook
type: string
type: object
PasswordImportRequestData:
properties:
action:
$ref: '#/components/schemas/PasswordImportRequestData_action'
context:
$ref: '#/components/schemas/PasswordImportRequestData_context'
type: object
PasswordImportResponse:
properties:
commands:
description: "The `commands` object specifies whether Okta accepts the end\
\ user's sign-in credentials as valid or not. For the password import\
\ inline hook, you typically only return one `commands` object with one\
\ array element in it."
items:
$ref: '#/components/schemas/PasswordImportResponse_commands_inner'
type: array
type: object
PasswordPolicy:
allOf:
- $ref: '#/components/schemas/Policy'
- properties:
conditions:
$ref: '#/components/schemas/PasswordPolicyConditions'
settings:
$ref: '#/components/schemas/PasswordPolicySettings'
type: object
PasswordPolicyAuthenticationProviderCondition:
properties:
include:
items:
type: string
type: array
provider:
$ref: '#/components/schemas/PasswordPolicyAuthenticationProviderType'
type: object
PasswordPolicyAuthenticationProviderType:
enum:
- ACTIVE_DIRECTORY
- ANY
- LDAP
- OKTA
type: string
PasswordPolicyConditions:
allOf:
- $ref: '#/components/schemas/PolicyRuleConditions'
- properties:
authProvider:
$ref: '#/components/schemas/PasswordPolicyAuthenticationProviderCondition'
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
type: object
PasswordPolicyDelegationSettings:
properties:
options:
$ref: '#/components/schemas/PasswordPolicyDelegationSettingsOptions'
type: object
PasswordPolicyDelegationSettingsOptions:
properties:
skipUnlock:
default: false
description: "Indicates if, when performing an unlock operation on an Active\
\ Directory sourced User who is locked out of Okta, the system should\
\ also attempt to unlock the User's Windows account"
type: boolean
type: object
PasswordPolicyPasswordSettings:
properties:
age:
$ref: '#/components/schemas/PasswordPolicyPasswordSettingsAge'
complexity:
$ref: '#/components/schemas/PasswordPolicyPasswordSettingsComplexity'
lockout:
$ref: '#/components/schemas/PasswordPolicyPasswordSettingsLockout'
type: object
PasswordPolicyPasswordSettingsAge:
description: Age settings
properties:
expireWarnDays:
default: 0
description: "Specifies the number of days prior to password expiration\
\ when a User is warned to reset their password: `0` indicates no warning"
type: integer
historyCount:
default: 0
description: "Specifies the number of distinct passwords that a User must\
\ create before they can reuse a previous password: `0` indicates none"
type: integer
maxAgeDays:
default: 0
description: "Specifies how long (in days) a password remains valid before\
\ it expires: `0` indicates no limit"
type: integer
minAgeMinutes:
default: 0
description: "Specifies the minimum time interval (in minutes) between password\
\ changes: `0` indicates no limit"
type: integer
type: object
PasswordPolicyPasswordSettingsComplexity:
description: Complexity settings
properties:
dictionary:
$ref: '#/components/schemas/PasswordDictionary'
excludeAttributes:
default: []
description: "The User profile attributes whose values must be excluded\
\ from the password: currently only supports `firstName` and `lastName`"
items:
type: string
type: array
excludeUsername:
default: true
description: Indicates if the Username must be excluded from the password
type: boolean
minLength:
default: 8
description: Minimum password length
type: integer
minLowerCase:
default: 1
description: "Indicates if a password must contain at least one lower case\
\ letter: `0` indicates no, `1` indicates yes"
type: integer
minNumber:
default: 1
description: "Indicates if a password must contain at least one number:\
\ `0` indicates no, `1` indicates yes"
type: integer
minSymbol:
default: 1
description: "Indicates if a password must contain at least one symbol (For\
\ example: !@#$%^&*): `0` indicates no, `1` indicates yes"
type: integer
minUpperCase:
default: 1
description: "Indicates if a password must contain at least one upper case\
\ letter: `0` indicates no, `1` indicates yes"
type: integer
type: object
PasswordPolicyPasswordSettingsLockout:
description: Lockout settings
properties:
autoUnlockMinutes:
default: 0
description: "Specifies the time interval (in minutes) a locked account\
\ remains locked before it is automatically unlocked: `0` indicates no\
\ limit"
type: integer
maxAttempts:
default: 10
description: "Specifies the number of times Users can attempt to sign in\
\ to their accounts with an invalid password before their accounts are\
\ locked: `0` indicates no limit"
type: integer
showLockoutFailures:
default: false
description: Indicates if the User should be informed when their account
is locked
type: boolean
userLockoutNotificationChannels:
default: []
description: "How the user is notified when their account becomes locked.\
\ The only acceptable values are `[]` and `['EMAIL']`."
items:
type: string
type: array
type: object
PasswordPolicyRecoveryEmail:
properties:
properties:
$ref: '#/components/schemas/PasswordPolicyRecoveryEmailProperties'
status:
$ref: '#/components/schemas/LifecycleStatus'
type: object
PasswordPolicyRecoveryEmailProperties:
properties:
recoveryToken:
$ref: '#/components/schemas/PasswordPolicyRecoveryEmailRecoveryToken'
type: object
PasswordPolicyRecoveryEmailRecoveryToken:
properties:
tokenLifetimeMinutes:
default: 10080
description: Lifetime (in minutes) of the recovery token
type: integer
type: object
PasswordPolicyRecoveryFactorSettings:
properties:
status:
$ref: '#/components/schemas/LifecycleStatus'
type: object
PasswordPolicyRecoveryFactors:
description: Settings for the Factors that can be used for recovery
properties:
okta_call:
$ref: '#/components/schemas/PasswordPolicyRecoveryFactorSettings'
okta_email:
$ref: '#/components/schemas/PasswordPolicyRecoveryEmail'
okta_sms:
$ref: '#/components/schemas/PasswordPolicyRecoveryFactorSettings'
recovery_question:
$ref: '#/components/schemas/PasswordPolicyRecoveryQuestion'
type: object
PasswordPolicyRecoveryQuestion:
properties:
properties:
$ref: '#/components/schemas/PasswordPolicyRecoveryQuestionProperties'
status:
$ref: '#/components/schemas/LifecycleStatus'
type: object
PasswordPolicyRecoveryQuestionComplexity:
properties:
minLength:
default: 4
description: Minimum length of the password recovery question answer
readOnly: true
type: integer
type: object
PasswordPolicyRecoveryQuestionProperties:
properties:
complexity:
$ref: '#/components/schemas/PasswordPolicyRecoveryQuestionComplexity'
type: object
PasswordPolicyRecoverySettings:
properties:
factors:
$ref: '#/components/schemas/PasswordPolicyRecoveryFactors'
type: object
PasswordPolicyRule:
allOf:
- $ref: '#/components/schemas/PolicyRule'
- properties:
actions:
$ref: '#/components/schemas/PasswordPolicyRuleActions'
conditions:
$ref: '#/components/schemas/PasswordPolicyRuleConditions'
type: object
PasswordPolicyRuleAction:
properties:
access:
$ref: '#/components/schemas/PolicyAccess'
type: object
PasswordPolicyRuleActions:
allOf:
- $ref: '#/components/schemas/PolicyRuleActions'
- properties:
passwordChange:
$ref: '#/components/schemas/PasswordPolicyRuleAction'
selfServicePasswordReset:
$ref: '#/components/schemas/SelfServicePasswordResetAction'
selfServiceUnlock:
$ref: '#/components/schemas/PasswordPolicyRuleAction'
type: object
PasswordPolicyRuleConditions:
properties:
network:
$ref: '#/components/schemas/PolicyNetworkCondition'
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
type: object
PasswordPolicySettings:
properties:
delegation:
$ref: '#/components/schemas/PasswordPolicyDelegationSettings'
password:
$ref: '#/components/schemas/PasswordPolicyPasswordSettings'
recovery:
$ref: '#/components/schemas/PasswordPolicyRecoverySettings'
type: object
PasswordProtectionWarningTrigger:
description: Indicates whether the Password Protection Warning feature is enabled
enum:
- PASSWORD_PROTECTION_OFF
- PASSWORD_REUSE
- PHISHING_REUSE
example: PHISHING_REUSE
type: string
x-enumDescriptions:
PASSWORD_PROTECTION_OFF: Password protection warning is off
PASSWORD_REUSE: Password protection warning is triggered by password reuse
PHISHING_REUSE: Password protection warning is triggered by password reuse
on a phishing page
PasswordSettingObject:
description: Determines whether Okta creates and pushes a password in the app
for each assigned user
properties:
change:
$ref: '#/components/schemas/ChangeEnum'
seed:
$ref: '#/components/schemas/SeedEnum'
status:
allOf:
- $ref: '#/components/schemas/EnabledStatus'
- default: DISABLED
- example: ENABLED
type: object
PatchAction:
description: The operation (PATCH action)
enum:
- remove
- replace
type: string
x-enumDescriptions:
remove: Removes the attribute in `path`
replace: Replaces the attribute in content `path` with the content in `value`
PerClientRateLimitMode:
enum:
- DISABLE
- ENFORCE
- PREVIEW
type: string
PerClientRateLimitSettings:
description: ""
example:
defaultMode: DISABLE
useCaseModeOverrides:
LOGIN_PAGE: null
OIE_APP_INTENT: null
OAUTH2_AUTHORIZE: null
properties:
defaultMode:
$ref: '#/components/schemas/PerClientRateLimitMode'
useCaseModeOverrides:
$ref: '#/components/schemas/PerClientRateLimitSettings_useCaseModeOverrides'
required:
- defaultMode
title: PerClientRateLimitSettings
type: object
Permission:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
role:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
label: label
conditions:
include:
key: "{}"
exclude:
key: "{}"
properties:
conditions:
$ref: '#/components/schemas/PermissionConditions'
created:
description: Timestamp when the role was created
format: date-time
readOnly: true
type: string
label:
description: The permission type
readOnly: true
type: string
lastUpdated:
description: Timestamp when the role was last updated
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/Permission__links'
type: object
PermissionConditions:
description: Conditions for further restricting a permission
example:
include:
key: "{}"
exclude:
key: "{}"
nullable: true
properties:
exclude:
additionalProperties:
properties: {}
type: object
description: Exclude attributes with specific values for the permission
nullable: true
type: object
include:
additionalProperties:
properties: {}
type: object
description: Include attributes with specific values for the permission
nullable: true
type: object
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
Permissions:
example:
permissions:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
role:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
label: label
conditions:
include:
key: "{}"
exclude:
key: "{}"
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
role:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
label: label
conditions:
include:
key: "{}"
exclude:
key: "{}"
properties:
permissions:
items:
$ref: '#/components/schemas/Permission'
type: array
type: object
PersonalAppsBlockList:
description: Defines a list of email domains with a subset of the properties
for each domain
properties:
domains:
description: List of blocked email domains
items:
description: TODO default missing array inner type to string
type: string
type: array
type: object
PinRequest:
description: Pin Request
example:
fulfillmentProvider: yubico
userId: userId
authenticatorEnrollmentId: authenticatorEnrollmentId
properties:
authenticatorEnrollmentId:
description: ID for a WebAuthn Preregistration Factor in Okta
type: string
fulfillmentProvider:
description: Name of the fulfillment provider for the WebAuthn Preregistration
Factor
enum:
- yubico
type: string
userId:
description: ID of an existing Okta user
type: string
type: object
PipelineType:
description: The authentication pipeline of the org
enum:
- idx
- v1
type: string
x-enumDescriptions:
idx: Identity Engine
v1: Classic Engine
Platform:
enum:
- ANDROID
- CHROMEOS
- IOS
- MACOS
- WINDOWS
type: string
PlatformConditionEvaluatorPlatform:
properties:
os:
$ref: '#/components/schemas/PlatformConditionEvaluatorPlatformOperatingSystem'
type:
$ref: '#/components/schemas/PolicyPlatformType'
type: object
PlatformConditionEvaluatorPlatformOperatingSystem:
properties:
expression:
type: string
type:
$ref: '#/components/schemas/PolicyPlatformOperatingSystemType'
version:
$ref: '#/components/schemas/PlatformConditionEvaluatorPlatformOperatingSystemVersion'
type: object
PlatformConditionEvaluatorPlatformOperatingSystemVersion:
properties:
matchType:
$ref: '#/components/schemas/PlatformConditionOperatingSystemVersionMatchType'
value:
type: string
type: object
PlatformConditionOperatingSystemVersionMatchType:
enum:
- EXPRESSION
- SEMVER
type: string
PlatformPolicyRuleCondition:
properties:
exclude:
items:
$ref: '#/components/schemas/PlatformConditionEvaluatorPlatform'
type: array
include:
items:
$ref: '#/components/schemas/PlatformConditionEvaluatorPlatform'
type: array
type: object
Policy:
discriminator:
mapping:
ACCESS_POLICY: '#/components/schemas/AccessPolicy'
IDP_DISCOVERY: '#/components/schemas/IdpDiscoveryPolicy'
MFA_ENROLL: '#/components/schemas/AuthenticatorEnrollmentPolicy'
OKTA_SIGN_ON: '#/components/schemas/OktaSignOnPolicy'
PASSWORD: '#/components/schemas/PasswordPolicy'
PROFILE_ENROLLMENT: '#/components/schemas/ProfileEnrollmentPolicy'
POST_AUTH_SESSION: '#/components/schemas/PostAuthSessionPolicy'
ENTITY_RISK: '#/components/schemas/EntityRiskPolicy'
propertyName: type
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
system: false
_embedded:
key: "{}"
_links:
mappings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
rules:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
name: name
description: description
id: Assigned
priority: 0
type: ACCESS_POLICY
status: ACTIVE
properties:
created:
description: Timestamp when the Policy was created
format: date-time
readOnly: true
type: string
description:
description: Description of the Policy
type: string
id:
default: Assigned
description: Identifier of the Policy
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Policy was last modified
format: date-time
readOnly: true
type: string
name:
description: Name of the Policy
type: string
priority:
description: Specifies the order in which this Policy is evaluated in relation
to the other policies
type: integer
status:
$ref: '#/components/schemas/LifecycleStatus'
system:
default: false
description: Specifies whether Okta created the Policy
type: boolean
type:
$ref: '#/components/schemas/PolicyType'
_embedded:
additionalProperties:
properties: {}
type: object
readOnly: true
type: object
_links:
$ref: '#/components/schemas/PolicyLinks'
required:
- name
- type
type: object
PolicyAccess:
enum:
- ALLOW
- DENY
type: string
PolicyAccountLink:
description: Specifies the behavior for linking an IdP User to an existing Okta
User
example:
filter:
groups:
include:
- 00gjg5lzfBpn62wuF0g3
- 00gjg5lzfBpn62wuF0g3
action: AUTO
properties:
action:
$ref: '#/components/schemas/PolicyAccountLinkAction'
filter:
$ref: '#/components/schemas/PolicyAccountLinkFilter'
type: object
PolicyAccountLinkAction:
description: Specifies the account linking action for an IdP User
enum:
- AUTO
- DISABLED
type: string
x-enumDescriptions:
AUTO: "The IdP User is automatically linked to an Okta User when the transformed\
\ IdP User matches an existing Okta User according to [subject match rules](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/subject&t=request)."
DISABLED: "Okta never attempts to link the IdP User to an existing Okta User,\
\ but may still attempt to provision a new Okta User according to the [provisioning\
\ action type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=policy/provisioning/action&t=request)."
PolicyAccountLinkFilter:
description: Specifies Group memberships to restrict which Users are available
for account linking by an IdP
example:
groups:
include:
- 00gjg5lzfBpn62wuF0g3
- 00gjg5lzfBpn62wuF0g3
properties:
groups:
$ref: '#/components/schemas/PolicyAccountLinkFilterGroups'
type: object
PolicyAccountLinkFilterGroups:
description: Group memberships used to determine link candidates
example:
include:
- 00gjg5lzfBpn62wuF0g3
- 00gjg5lzfBpn62wuF0g3
properties:
include:
description: Specifies the allowlist of Group identifiers to match against.
Group memberships are restricted to type `OKTA_GROUP`.
items:
example: 00gjg5lzfBpn62wuF0g3
type: string
type: array
type: object
PolicyContext:
example:
ip: ip
groups:
ids:
- ids
- ids
risk:
level: LOW
zones:
ids:
- ids
- ids
device:
managed: true
registered: true
platform: platform
assuranceId: assuranceId
user:
id: id
properties:
device:
$ref: '#/components/schemas/PolicyContext_device'
groups:
$ref: '#/components/schemas/PolicyContext_groups'
ip:
description: "The network rule condition, zone, or IP address"
type: string
risk:
$ref: '#/components/schemas/PolicyContext_risk'
user:
$ref: '#/components/schemas/PolicyContext_user'
zones:
$ref: '#/components/schemas/PolicyContext_zones'
required:
- groups
- user
type: object
PolicyLinks:
example:
mappings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
rules:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
activate:
$ref: '#/components/schemas/HrefObjectActivateLink'
deactivate:
$ref: '#/components/schemas/HrefObjectDeactivateLink'
mappings:
$ref: '#/components/schemas/HrefObjectMappingsLink'
rules:
$ref: '#/components/schemas/HrefObjectRulesLink'
self:
$ref: '#/components/schemas/HrefObjectSelfLink'
readOnly: true
type: object
PolicyMapping:
example:
_links:
application:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
policy:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
properties:
id:
type: string
_links:
$ref: '#/components/schemas/PolicyMapping__links'
type: object
PolicyMappingRequest:
example:
resourceId: resourceId
resourceType: APP
properties:
resourceId:
type: string
resourceType:
$ref: '#/components/schemas/PolicyMappingResourceType'
type: object
PolicyMappingResourceType:
enum:
- APP
type: string
PolicyNetworkCondition:
properties:
connection:
$ref: '#/components/schemas/PolicyNetworkConnection'
exclude:
description: The zones to exclude. Required only if connection data type
is `ZONE`
items:
type: string
type: array
include:
description: The zones to include. Required only if connection data type
is `ZONE`
items:
type: string
type: array
type: object
PolicyNetworkConnection:
description: Network selection mode
enum:
- ANYWHERE
- ZONE
type: string
PolicyPeopleCondition:
description: Identifies Users and Groups that are used together
properties:
groups:
$ref: '#/components/schemas/GroupCondition'
users:
$ref: '#/components/schemas/UserCondition'
required:
- groups
- users
type: object
PolicyPlatformOperatingSystemType:
enum:
- ANDROID
- ANY
- IOS
- OSX
- OTHER
- WINDOWS
type: string
PolicyPlatformType:
enum:
- ANY
- DESKTOP
- MOBILE
- OTHER
type: string
PolicyRule:
discriminator:
mapping:
ACCESS_POLICY: '#/components/schemas/AccessPolicyRule'
PASSWORD: '#/components/schemas/PasswordPolicyRule'
PROFILE_ENROLLMENT: '#/components/schemas/ProfileEnrollmentPolicyRule'
RESOURCE_ACCESS: '#/components/schemas/AuthorizationServerPolicyRule'
SIGN_ON: '#/components/schemas/OktaSignOnPolicyRule'
IDP_DISCOVERY: '#/components/schemas/IdpDiscoveryPolicyRule'
POST_AUTH_SESSION: '#/components/schemas/PostAuthSessionPolicyRule'
ENTITY_RISK: '#/components/schemas/EntityRiskPolicyRule'
MFA_ENROLL: '#/components/schemas/AuthenticatorEnrollmentPolicyRule'
propertyName: type
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
system: false
_links:
mappings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
rules:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
name: name
id: id
priority: 0
type: ACCESS_POLICY
status: ACTIVE
properties:
created:
description: Timestamp when the rule was created
format: date-time
nullable: true
readOnly: true
type: string
id:
description: Identifier for the rule
type: string
lastUpdated:
description: Timestamp when the rule was last modified
format: date-time
nullable: true
readOnly: true
type: string
name:
description: Name of the rule
type: string
priority:
description: Priority of the rule
type: integer
status:
$ref: '#/components/schemas/LifecycleStatus'
system:
default: false
description: Specifies whether Okta created the Policy Rule (`system=true`).
You can't delete Policy Rules that have `system` set to `true`.
type: boolean
type:
$ref: '#/components/schemas/PolicyRuleType'
_links:
$ref: '#/components/schemas/PolicyLinks'
type: object
PolicyRuleActions:
type: object
PolicyRuleActionsEnroll:
properties:
self:
$ref: '#/components/schemas/PolicyRuleActionsEnrollSelf'
type: object
PolicyRuleActionsEnrollSelf:
enum:
- CHALLENGE
- LOGIN
- NEVER
type: string
PolicyRuleAuthContextCondition:
properties:
authType:
$ref: '#/components/schemas/PolicyRuleAuthContextType'
type: object
PolicyRuleAuthContextType:
enum:
- ANY
- LDAP_INTERFACE
- RADIUS
type: string
PolicyRuleConditions:
properties:
app:
$ref: '#/components/schemas/AppAndInstancePolicyRuleCondition'
apps:
$ref: '#/components/schemas/AppInstancePolicyRuleCondition'
authContext:
$ref: '#/components/schemas/PolicyRuleAuthContextCondition'
authProvider:
$ref: '#/components/schemas/PasswordPolicyAuthenticationProviderCondition'
beforeScheduledAction:
$ref: '#/components/schemas/BeforeScheduledActionPolicyRuleCondition'
clients:
$ref: '#/components/schemas/ClientPolicyCondition'
context:
$ref: '#/components/schemas/ContextPolicyRuleCondition'
device:
$ref: '#/components/schemas/DevicePolicyRuleCondition'
grantTypes:
$ref: '#/components/schemas/GrantTypePolicyRuleCondition'
groups:
$ref: '#/components/schemas/GroupPolicyRuleCondition'
identityProvider:
$ref: '#/components/schemas/IdentityProviderPolicyRuleCondition'
mdmEnrollment:
$ref: '#/components/schemas/MDMEnrollmentPolicyRuleCondition'
network:
$ref: '#/components/schemas/PolicyNetworkCondition'
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
platform:
$ref: '#/components/schemas/PlatformPolicyRuleCondition'
risk:
$ref: '#/components/schemas/RiskPolicyRuleCondition'
riskScore:
$ref: '#/components/schemas/RiskScorePolicyRuleCondition'
scopes:
$ref: '#/components/schemas/OAuth2ScopesMediationPolicyRuleCondition'
userIdentifier:
$ref: '#/components/schemas/UserIdentifierPolicyRuleCondition'
users:
$ref: '#/components/schemas/UserPolicyRuleCondition'
userStatus:
$ref: '#/components/schemas/UserStatusPolicyRuleCondition'
type: object
PolicyRuleType:
description: Rule type
enum:
- ACCESS_POLICY
- ENTITY_RISK
- IDP_DISCOVERY
- MFA_ENROLL
- PASSWORD
- POST_AUTH_SESSION
- PROFILE_ENROLLMENT
- RESOURCE_ACCESS
- SIGN_ON
type: string
PolicyRuleVerificationMethodType:
description: Verification method type
enum:
- ASSURANCE
- AUTH_METHOD_CHAIN
type: string
PolicySubject:
description: "Specifies the behavior for establishing, validating, and matching\
\ a username for an IdP User"
example:
filter: (\S+@example\.com)
matchAttribute: login
matchType: CUSTOM_ATTRIBUTE
userNameTemplate:
template: idpuser.subjectNameId
properties:
filter:
description: |-
Optional [regular expression pattern](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Regular_expressions) used to filter untrusted IdP usernames.
* As a best security practice, you should define a regular expression pattern to filter untrusted IdP usernames. This is especially important if multiple IdPs are connected to your org. The filter prevents an IdP from issuing an assertion for any User, including partners or directory Users in your Okta org.
* For example, the filter pattern `(\S+@example\.com)` allows only Users that have an `@example.com` username suffix. It rejects assertions that have any other suffix such as `@corp.example.com` or `@partner.com`.
* Only `SAML2` and `OIDC` IdP providers support the `filter` property.
example: (\S+@example\.com)
maxLength: 1024
type: string
matchAttribute:
description: |-
Okta User profile attribute for matching a transformed IdP username. Only for matchType `CUSTOM_ATTRIBUTE`.
The `matchAttribute` must be a valid Okta User profile attribute of one of the following types:
* String (with no format or 'email' format only)
* Integer
* Number
example: login
type: string
matchType:
$ref: '#/components/schemas/PolicySubjectMatchType'
userNameTemplate:
$ref: '#/components/schemas/PolicyUserNameTemplate'
type: object
PolicySubjectMatchType:
description: Determines the Okta User profile attribute match conditions for
account linking and authentication of the transformed IdP username
enum:
- CUSTOM_ATTRIBUTE
- EMAIL
- USERNAME
- USERNAME_OR_EMAIL
type: string
PolicyType:
description: "All Okta orgs contain only one IdP Discovery Policy with an immutable\
\ default Rule routing to your org's sign-in page. \nCreating or replacing\
\ a policy with the `IDP_DISCOVERY` type isn't supported. The following policy\
\ types are available with\nIdentity Engine: `ACCESS_POLICY`, `PROFILE_ENROLLMENT`,\
\ `POST_AUTH_SESSION`, and `ENTITY_RISK`. The `POST_AUTH_SESSION`, and `ENTITY_RISK`\
\ \npolicy types are in <x-lifecycle class=\"ea\"></x-lifecycle>. Contact\
\ your Okta account team to enable these features."
enum:
- ACCESS_POLICY
- ENTITY_RISK
- IDP_DISCOVERY
- MFA_ENROLL
- OKTA_SIGN_ON
- PASSWORD
- POST_AUTH_SESSION
- PROFILE_ENROLLMENT
- RESOURCE_ACCESS
type: string
PolicyTypeSimulation:
enum:
- ACCESS_POLICY
- MFA_ENROLL
- OKTA_SIGN_ON
- PROFILE_ENROLLMENT
type: string
PolicyUserNameTemplate:
description: |-
[Okta Expression Language (EL) expression](https://developer.okta.com/docs/reference/okta-expression-language/) to generate or transform a unique username for the IdP User.
* IdP User profile attributes can be referenced with the `idpuser` prefix such as `idpuser.subjectNameId`.
* You must define an IdP User profile attribute before it can be referenced in an Okta EL expression. To define an IdP User attribute policy, you may need to create a new IdP instance without a base profile property. Then edit the IdP User profile to update the IdP instance with an expression that references the IdP User profile attribute that you just created.
example:
template: idpuser.subjectNameId
properties:
template:
example: idpuser.subjectNameId
maxLength: 1024
minLength: 9
type: string
type: object
PolicyUserStatus:
enum:
- ACTIVATING
- ACTIVE
- DELETED
- DELETING
- EXPIRED_PASSWORD
- INACTIVE
- PENDING
- SUSPENDED
type: string
PossessionConstraint:
allOf:
- $ref: '#/components/schemas/AccessPolicyConstraint'
- properties:
deviceBound:
default: OPTIONAL
description: Indicates if device-bound Factors are required. This property
is only set for `POSSESSION` constraints.
enum:
- OPTIONAL
- REQUIRED
type: string
hardwareProtection:
default: OPTIONAL
description: Indicates if any secrets or private keys used during authentication
must be hardware protected and not exportable. This property is only
set for `POSSESSION` constraints.
enum:
- OPTIONAL
- REQUIRED
type: string
phishingResistant:
default: OPTIONAL
description: Indicates if phishing-resistant Factors are required. This
property is only set for `POSSESSION` constraints.
enum:
- OPTIONAL
- REQUIRED
type: string
userPresence:
default: REQUIRED
description: Indicates if the user needs to approve an Okta Verify prompt
or provide biometrics (meets NIST AAL2 requirements). This property
is only set for `POSSESSION` constraints.
enum:
- OPTIONAL
- REQUIRED
type: string
userVerification:
default: OPTIONAL
description: Indicates the user interaction requirement (PIN or biometrics)
to ensure verification of a possession factor
enum:
- OPTIONAL
- REQUIRED
type: string
type: object
PostAuthKeepMeSignedInPrompt:
properties:
acceptButtonText:
description: The label on the accept button when prompting for Stay signed
in
type: string
rejectButtonText:
description: The label on the reject button when prompting for Stay signed
in
type: string
subtitle:
description: The subtitle on the Sign-In Widget when prompting for Stay
signed in
type: string
title:
description: The title on the Sign-In Widget when prompting for Stay signed
in
type: string
type: object
PostAuthSessionFailureActionsObject:
discriminator:
mapping:
RUN_WORKFLOW: '#/components/schemas/PostAuthSessionPolicyRuleRunWorkflow'
TERMINATE_SESSION: '#/components/schemas/PostAuthSessionPolicyRuleTerminateSession'
propertyName: action
properties:
action:
enum:
- RUN_WORKFLOW
- TERMINATE_SESSION
type: string
type: object
PostAuthSessionPolicy:
allOf:
- $ref: '#/components/schemas/Policy'
- properties:
conditions:
description: Policy conditions aren't supported for this policy type.
nullable: true
type: string
type: object
PostAuthSessionPolicyRule:
allOf:
- $ref: '#/components/schemas/PolicyRule'
- properties:
actions:
$ref: '#/components/schemas/PostAuthSessionPolicyRule_allOf_actions'
conditions:
$ref: '#/components/schemas/PostAuthSessionPolicyRule_allOf_conditions'
type: object
PostAuthSessionPolicyRuleRunWorkflow:
properties:
action:
enum:
- RUN_WORKFLOW
type: string
workflow:
$ref: '#/components/schemas/EntityRiskPolicyRuleActionRunWorkflow_workflow'
type: object
PostAuthSessionPolicyRuleTerminateSession:
properties:
action:
description: The action to take when post auth session evaluation detects
a failure.
enum:
- TERMINATE_SESSION
type: string
type: object
PreRegistrationInlineHook:
properties:
inlineHookId:
type: string
type: object
PrincipalRateLimitEntity:
description: ""
example:
defaultConcurrencyPercentage: 0
lastUpdatedBy: lastUpdatedBy
createdDate: 2000-01-23T04:56:07.000+00:00
createdBy: createdBy
lastUpdate: 2000-01-23T04:56:07.000+00:00
defaultPercentage: 6
principalId: principalId
id: id
orgId: orgId
principalType: SSWS_TOKEN
properties:
createdBy:
readOnly: true
type: string
createdDate:
format: date-time
readOnly: true
type: string
defaultConcurrencyPercentage:
readOnly: true
type: integer
defaultPercentage:
readOnly: true
type: integer
id:
readOnly: true
type: string
lastUpdate:
format: date-time
readOnly: true
type: string
lastUpdatedBy:
readOnly: true
type: string
orgId:
readOnly: true
type: string
principalId:
type: string
principalType:
$ref: '#/components/schemas/PrincipalType'
required:
- principalId
- principalType
title: PrincipalRateLimitEntity
type: object
PrincipalType:
enum:
- SSWS_TOKEN
type: string
PrivilegedAccount:
discriminator:
mapping:
APP_ACCOUNT: '#/components/schemas/PrivilegedAccountDetailsAppAccount'
OKTA_USER_ACCOUNT: '#/components/schemas/PrivilegedAccountDetailsOktaUserAccount'
propertyName: accountType
properties:
accountType:
$ref: '#/components/schemas/PrivilegedAccountType'
created:
description: Timestamp when the Privileged Account was created
format: date-time
readOnly: true
type: string
description:
description: The description of the Privileged Account
example: This is for accessing AWS Prod-5
format: regex
maxLength: 255
minLength: 0
type: string
id:
description: The UUID of the Privileged Account
example: a747a818-a4c4-4446-8a87-704216495a08
format: regex
pattern: "(?i)^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Privileged Account was last updated
format: date-time
readOnly: true
type: string
name:
description: The human-readable name for the Privileged Account
example: AWS Prod-5 account
format: regex
maxLength: 50
minLength: 1
pattern: "^[\\w\\-_. ]+$"
type: string
ownerGroupIds:
description: A list of IDs of the Okta groups that own the Privileged Account
example:
- 00g57qp78yZT2XBA40g7
items:
type: string
maxItems: 10
minItems: 0
type: array
ownerUserIds:
description: A list of IDs of the Okta users that own the Privileged Account
example:
- 00u11s48P9zGW8yqm0g5
items:
type: string
maxItems: 10
minItems: 0
type: array
status:
$ref: '#/components/schemas/PrivilegedAccountStatus'
statusDetail:
$ref: '#/components/schemas/PrivilegedAccountStatusDetail'
required:
- accountType
- name
type: object
PrivilegedAccountCredentials:
description: Credentials for a Privileged Account
properties:
password:
description: The password associated with the Privileged Account
format: password
type: string
writeOnly: true
username:
description: The username associated with the Privileged Account
example: testuser@example.com
maxLength: 100
minLength: 1
type: string
required:
- username
type: object
PrivilegedAccountDetailsAppAccount:
allOf:
- $ref: '#/components/schemas/PrivilegedAccount'
- properties:
details:
$ref: '#/components/schemas/PrivilegedAccountDetailsAppAccountSub'
required:
- details
type: object
description: "Details for a SaaS Application Account, which will be managed\
\ as a Privileged Account"
PrivilegedAccountDetailsAppAccountSub:
description: "Details for a SaaS Application Account, which will be managed\
\ as a Privileged Account"
properties:
appGlobalName:
description: The name of the SaaS Application in the Okta Integration Network
catalog
example: Salesforce
type: string
appInstanceName:
description: The instance name of the SaaS Application
example: Salesforce Prod
type: string
credentials:
$ref: '#/components/schemas/PrivilegedAccountCredentials'
oktaApplicationId:
description: The Okta app instance ID of the SaaS Application
example: aln1aqcs055ZRoizW0g8
type: string
required:
- credentials
- oktaApplicationId
type: object
PrivilegedAccountDetailsOktaUserAccount:
allOf:
- $ref: '#/components/schemas/PrivilegedAccount'
- properties:
details:
$ref: '#/components/schemas/PrivilegedAccountDetailsOktaUserAccountSub'
required:
- details
type: object
description: Details for managing an Okta Universal Directory Account as a Privileged
Account
PrivilegedAccountDetailsOktaUserAccountSub:
description: Details for managing an Okta Universal Directory Account as a Privileged
Account
properties:
credentials:
$ref: '#/components/schemas/PrivilegedAccountCredentials'
email:
description: The email address for the Okta Universal Directory Account
example: foo@bar.com
maxLength: 100
minLength: 5
type: string
oktaUserId:
description: "An optional Okta user ID. If supplied, converts the matching\
\ Okta Universal Directory Account to a Privileged Account and updates\
\ the account with the provided details."
example: 00u11s48P9zGW8yqm0g5
type: string
required:
- credentials
- email
type: object
PrivilegedAccountForUpdate:
properties:
description:
description: The description of the Privileged Account
example: This is for accessing AWS Prod-5
format: regex
maxLength: 255
minLength: 0
type: string
email:
description: The email address for the Okta Universal Directory Account
example: foo@bar.com
maxLength: 100
minLength: 5
type: string
name:
description: The human-readable name for the Privileged Account
example: AWS Prod-5 account
format: regex
maxLength: 50
minLength: 1
pattern: "^[\\w\\-_. ]+$"
type: string
ownerGroupIds:
description: A list of IDs of the Okta groups who own the Privileged Account
example:
- 00g57qp78yZT2XBA40g7
items:
type: string
maxItems: 10
minItems: 0
type: array
ownerUserIds:
description: A list of IDs of the Okta users who own the Privileged Account
example:
- 00u11s48P9zGW8yqm0g5
items:
type: string
maxItems: 10
minItems: 0
type: array
username:
description: The username associated with the Privileged Account
example: testuser@example.com
maxLength: 100
minLength: 1
type: string
type: object
PrivilegedAccountStatus:
description: Describes the current status of a Privileged Account
enum:
- ALERT
- ERROR
- INFO
- NO_ISSUES
- UNSECURED
type: string
x-enumDescriptions:
NO_ISSUES: The Account is ready for use in Okta Privileged Access
UNSECURED: The Account needs to be assigned to a Resource Group and a Project
in Okta Privileged Access
INFO: An action involving the Account is currently in progress in Okta Privileged
Access
ALERT: The Account requires attention from an Administrator
ERROR: An error is preventing the Account from being used in Okta Privileged
Access
PrivilegedAccountStatusDetail:
description: Describes the detailed status of a Privileged Account
enum:
- CREATION_FAILED
- MISSING_PASSWORD
- PENDING
- ROTATED
- ROTATING
- ROTATION_FAILED
- STAGED
- VAULTED
type: string
x-enumDescriptions:
PENDING: The Account is in the process of being created
CREATION_FAILED: The Account could not be created
STAGED: The Account is in the Okta Privileged Access resource assignment area
ROTATING: The Account is assigned to a Project in Okta Privileged Access.
Credentials are currently being synced using Okta Lifecycle Management.
ROTATED: The Account is assigned to a Project in Okta Privileged Access. Password
rotations are fulfilled by Okta Lifecycle Management.
ROTATION_FAILED: The Account is assigned to a Project in Okta Privileged Access.
An error occurred while using Okta Lifecycle Management to rotate the password.
VAULTED: The Account is assigned to a Project in Okta Privileged Access. A
manually managed password is assigned to the Account.
MISSING_PASSWORD: The Account is assigned to a Project in Okta Privileged
Access. A password is not assigned to the Account.
PrivilegedAccountType:
description: The type of Privileged Account
enum:
- APP_ACCOUNT
- OKTA_USER_ACCOUNT
type: string
x-enumDescriptions:
APP_ACCOUNT: SaaS Application Account
OKTA_USER_ACCOUNT: Okta Universal Directory Account
PrivilegedResource:
default:
resourceType: OKTA_USER_ACCOUNT
discriminator:
mapping:
APP_ACCOUNT: '#/components/schemas/PrivilegedResourceAccountApp'
OKTA_USER_ACCOUNT: '#/components/schemas/PrivilegedResourceAccountOkta'
propertyName: resourceType
properties:
created:
description: Timestamp when the object was created
example: 2024-06-10T11:11:01Z
format: date-time
readOnly: true
type: string
credentialSyncInfo:
$ref: '#/components/schemas/CredentialSyncInfo'
id:
description: ID of the privileged resource
example: opa100xTfFs4MasRf0g4
readOnly: true
type: string
lastUpdated:
description: Timestamp when the object was last updated
example: 2024-06-10T11:13:01Z
format: date-time
readOnly: true
type: string
resourceType:
$ref: '#/components/schemas/PrivilegedResourceType'
status:
$ref: '#/components/schemas/PrivilegedResourceStatus'
type: object
PrivilegedResourceAccountApp:
allOf:
- properties:
containerDetails:
$ref: '#/components/schemas/AppAccountContainerDetails'
credentials:
$ref: '#/components/schemas/PrivilegedResourceCredentials'
type: object
- $ref: '#/components/schemas/PrivilegedResource'
required:
- containerId
PrivilegedResourceAccountOkta:
allOf:
- properties:
resourceId:
description: The user ID associated with the Okta privileged resource
example: 00u100xTfFs4MasRf0g4
type: string
credentials:
$ref: '#/components/schemas/PrivilegedResourceCredentials'
profile:
$ref: '#/components/schemas/profile'
type: object
- $ref: '#/components/schemas/PrivilegedResource'
PrivilegedResourceCredentials:
description: Credentials for the privileged account
properties:
password:
description: The password associated with the privileged resource
example: xf1bs9am2
format: password
type: string
writeOnly: true
userName:
description: The username associated with the privileged resource
example: testuser@example.com
maxLength: 100
minLength: 1
type: string
required:
- userName
type: object
PrivilegedResourceStatus:
description: Current status of the privileged resource
enum:
- ACTIVE
- CREATED
- CREATION_FAILED
- INACTIVE
- PENDING
readOnly: true
type: string
x-enumDescriptions:
CREATED: The privileged resource is created but not yet managed by OPA
ACTIVE: The privileged resource is currently managed by OPA
INACTIVE: The privileged resource is `INACTIVE` and not currently managed
by OPA
PrivilegedResourceType:
description: The type of the resource
enum:
- APP_ACCOUNT
- OKTA_USER_ACCOUNT
type: string
PrivilegedResourceUpdateRequest:
description: Update request for a privileged resource
properties:
profile:
additionalProperties:
properties: {}
type: object
description: Specific profile properties for the privileged account
readOnly: true
type: object
userName:
description: The username associated with the privileged resource
example: testuser@example.com
maxLength: 100
minLength: 1
type: string
type: object
ProfileEnrollmentPolicy:
allOf:
- $ref: '#/components/schemas/Policy'
- properties:
conditions:
description: Policy conditions aren't supported for this policy type
nullable: true
type: string
type: object
ProfileEnrollmentPolicyRule:
allOf:
- $ref: '#/components/schemas/PolicyRule'
- properties:
actions:
$ref: '#/components/schemas/ProfileEnrollmentPolicyRuleActions'
conditions:
description: Policy Rule conditions aren't supported for this policy type
nullable: true
type: string
type: object
ProfileEnrollmentPolicyRuleAction:
properties:
access:
description: '**Note:** The Profile Enrollment Action object can''t be modified
to set the `access` property to `DENY` after the policy is created.'
enum:
- ALLOW
- DENY
type: string
activationRequirements:
$ref: '#/components/schemas/ProfileEnrollmentPolicyRuleActivationRequirement'
allowedIdentifiers:
default:
- login
description: "<x-lifecycle class=\"ea\"></x-lifecycle> A list of attributes\
\ to identify an end user. Can be used across Okta sign-in, unlock, and\
\ recovery flows."
items:
type: string
type: array
enrollAuthenticatorTypes:
description: Additional authenticator fields that can be used on the first
page of user registration. Valid values only includes `'password'`.
items:
type: string
type: array
preRegistrationInlineHooks:
description: (Optional) The `id` of at most one registration inline hook
items:
$ref: '#/components/schemas/PreRegistrationInlineHook'
type: array
profileAttributes:
description: "A list of attributes to prompt the user during registration\
\ or progressive profiling. Where defined on the User schema, these attributes\
\ are persisted in the User profile. Non-schema attributes can also be\
\ added, which aren't persisted to the User's profile, but are included\
\ in requests to the registration inline hook. A maximum of 10 Profile\
\ properties is supported."
items:
$ref: '#/components/schemas/ProfileEnrollmentPolicyRuleProfileAttribute'
type: array
progressiveProfilingAction:
description: Progressive profile enrollment helps evaluate the profile enrollment
policy at every user login. Users can be prompted to provide input for
newly required attributes.
enum:
- ENABLED
- DISABLED
type: string
targetGroupIds:
description: "(Optional, max 1 entry) The `id` of a Group that this User\
\ should be added to"
items:
type: string
type: array
uiSchemaId:
description: "Value created by the backend. If present, all policy updates\
\ must include this attribute/value."
type: string
unknownUserAction:
description: Which action should be taken if this User is new
enum:
- DENY
- REGISTER
type: string
type: object
ProfileEnrollmentPolicyRuleActions:
allOf:
- $ref: '#/components/schemas/PolicyRuleActions'
- properties:
profileEnrollment:
$ref: '#/components/schemas/ProfileEnrollmentPolicyRuleAction'
type: object
ProfileEnrollmentPolicyRuleActivationRequirement:
description: "Contains a single Boolean property that indicates whether `emailVerification`\
\ should occur (`true`) or not (`false`, default)"
properties:
emailVerification:
type: boolean
type: object
ProfileEnrollmentPolicyRuleProfileAttribute:
properties:
label:
description: A display-friendly label for this property
type: string
name:
description: The name of a User Profile property. Can be an existing property.
type: string
required:
default: false
description: "(Optional, default `FALSE`) Indicates if this property is\
\ required for enrollment"
type: boolean
type: object
ProfileMapping:
description: |-
The Profile Mapping object describes a mapping between an Okta User's and an App User's properties using [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04).
> **Note:** Same type source/target mappings aren't supported by this API. Profile mappings must either be Okta->App or App->Okta.
example:
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
source:
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: type
properties:
key:
expression: expression
pushStatus: DONT_PUSH
target:
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: type
properties:
id:
description: Unique identifier for a profile mapping
readOnly: true
type: string
properties:
additionalProperties:
$ref: '#/components/schemas/ProfileMappingProperty'
readOnly: false
type: object
source:
$ref: '#/components/schemas/ProfileMappingSource'
target:
$ref: '#/components/schemas/ProfileMappingTarget'
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
ProfileMappingProperty:
description: "A target property, in string form, that maps to a valid [JSON\
\ Schema Draft](https://tools.ietf.org/html/draft-zyp-json-schema-04) document."
example:
expression: expression
pushStatus: DONT_PUSH
properties:
expression:
description: Combination or single source properties that are mapped to
the target property
type: string
pushStatus:
$ref: '#/components/schemas/ProfileMappingPropertyPushStatus'
type: object
ProfileMappingPropertyPushStatus:
description: |-
Indicates whether to update target properties for user create and update or just for user create.
Having a pushStatus of `PUSH` causes properties in the target to be updated on create and update. Having a pushStatus of `DONT_PUSH` causes properties in the target to be updated only on create.
enum:
- DONT_PUSH
- PUSH
type: string
ProfileMappingRequest:
description: The updated request body properties
example:
properties:
key:
expression: expression
pushStatus: DONT_PUSH
properties:
properties:
additionalProperties:
$ref: '#/components/schemas/ProfileMappingProperty'
type: object
required:
- additionalProperties
- expression
- properties
- pushStatus
type: object
ProfileMappingSource:
description: |-
The parameter is the source of a profile mapping and is a valid [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04) document with the following properties. The data type can be an app instance or an Okta object.
> **Note:** If the source is Okta and the UserTypes feature isn't enabled, then the source `_links` only has a link to the schema.
example:
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: type
properties:
id:
description: Unique identifier for the application instance or userType
readOnly: true
type: string
name:
description: Variable name of the application instance or name of the referenced
UserType
readOnly: true
type: string
type:
description: Type of user referenced in the mapping
readOnly: true
type: string
_links:
$ref: '#/components/schemas/SourceLinks'
type: object
ProfileMappingTarget:
description: |-
The parameter is the target of a profile mapping and is a valid [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04) document with the following properties. The data type can be an app instance or an Okta object.
> **Note:** If the target is Okta and the UserTypes feature isn't enabled, then the target `_links` only has a link to the schema.
example:
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
type: type
properties:
id:
description: Unique identifier for the application instance or UserType
readOnly: true
type: string
name:
description: Variable name of the application instance or name of the referenced
userType
readOnly: true
type: string
type:
description: Type of user referenced in the mapping
readOnly: true
type: string
_links:
$ref: '#/components/schemas/SourceLinks'
type: object
ProfileSettingObject:
description: |
This setting determines whether a user in the app gets updated when they're updated in Okta.
If enabled, Okta updates a user's attributes in the app when the app is assigned.
Future changes made to the Okta user's profile automatically overwrite the corresponding attribute value in the app.
properties:
status:
allOf:
- $ref: '#/components/schemas/EnabledStatus'
- example: DISABLED
- default: DISABLED
type: object
Protocol:
example:
algorithms:
request:
signature:
scope: ANY
algorithm: algorithm
response:
signature:
scope: ANY
algorithm: algorithm
relayState:
format: FROM_URL
settings:
nameFormat: nameFormat
endpoints:
acs:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
authorization:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
userInfo:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
metadata:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
jwks:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
slo:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
sso:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
token:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
credentials:
trust:
revocation: CRL
audience: audience
revocationCacheLifetime: 0
kid: kid
issuer: issuer
client:
pkce_required: true
client_secret: client_secret
client_id: client_id
signing:
kid: kid
scopes:
- scopes
- scopes
type: MTLS
issuer:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
properties:
algorithms:
$ref: '#/components/schemas/ProtocolAlgorithms'
credentials:
$ref: '#/components/schemas/IdentityProviderCredentials'
endpoints:
$ref: '#/components/schemas/ProtocolEndpoints'
issuer:
$ref: '#/components/schemas/ProtocolEndpoint'
relayState:
$ref: '#/components/schemas/ProtocolRelayState'
scopes:
items:
type: string
type: array
settings:
$ref: '#/components/schemas/ProtocolSettings'
type:
$ref: '#/components/schemas/ProtocolType'
type: object
ProtocolAlgorithmRequestScope:
description: Specifies whether to digitally sign authorization requests to the
IdP
enum:
- NONE
- REQUEST
example: REQUEST
type: string
ProtocolAlgorithmResponseScope:
description: Specifies whether to verify responses from the IdP
enum:
- ANY
- RESPONSE
- TOKEN
example: ANY
type: string
ProtocolCredentialsKeyId:
description: IdP Key Credential reference to the Okta X.509 signature certificate
example: your-key-id
type: string
ProtocolEndpointBinding:
enum:
- HTTP-POST
- HTTP-REDIRECT
type: string
ProtocolMtls:
description: "Protocol settings for the [MTLS Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4)"
properties:
credentials:
$ref: '#/components/schemas/MtlsCredentials'
endpoints:
$ref: '#/components/schemas/MtlsEndpoints'
type:
description: Mutual TLS
enum:
- MTLS
type: string
title: Mutual TLS Protocol
type: object
ProtocolOAuth:
description: "Protocol settings for authentication using the [OAuth 2.0 Authorization\
\ Code flow](https://tools.ietf.org/html/rfc6749#section-4.1)"
properties:
credentials:
$ref: '#/components/schemas/OAuthCredentials'
endpoints:
$ref: '#/components/schemas/OAuthEndpoints'
scopes:
description: |-
IdP-defined permission bundles to request delegated access from the User
> **Note:** The [Identity Provider type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) table lists the scopes that are supported for each Identity Provider.
items:
example: public_profile
type: string
type: array
type:
description: OAuth 2.0 Authorization Code flow
enum:
- OAUTH2
type: string
title: OAuth 2.0 Protocol
type: object
ProtocolOidc:
description: "Protocol settings for authentication using the [OpenID Connect\
\ Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth)"
properties:
algorithms:
$ref: '#/components/schemas/OidcAlgorithms'
credentials:
$ref: '#/components/schemas/OAuthCredentials'
endpoints:
$ref: '#/components/schemas/OAuthEndpoints'
scopes:
description: |-
OpenID Connect and IdP-defined permission bundles to request delegated access from the User
> **Note:** The [Identity Provider type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=type&t=request) table lists the scopes that are supported for each Identity Provider.
items:
example: openid
type: string
type: array
type:
description: OpenID Connect Authorization Code flow
enum:
- OIDC
type: string
title: OpenID Connect Protocol
type: object
ProtocolSaml:
description: "Protocol settings for the [SAML 2.0 Authentication Request Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf)"
properties:
algorithms:
$ref: '#/components/schemas/SamlAlgorithms'
credentials:
$ref: '#/components/schemas/SamlCredentials'
endpoints:
$ref: '#/components/schemas/SamlEndpoints'
relayState:
$ref: '#/components/schemas/SamlRelayState'
settings:
$ref: '#/components/schemas/SamlSettings'
type:
description: SAML 2.0 protocol
enum:
- SAML2
type: string
title: SAML 2.0 Protocol
type: object
ProtocolAlgorithmType:
example:
signature:
scope: ANY
algorithm: algorithm
properties:
signature:
$ref: '#/components/schemas/ProtocolAlgorithmTypeSignature'
type: object
ProtocolAlgorithmTypeSignature:
example:
scope: ANY
algorithm: algorithm
properties:
algorithm:
type: string
scope:
$ref: '#/components/schemas/ProtocolAlgorithmTypeSignatureScope'
type: object
ProtocolAlgorithmTypeSignatureScope:
enum:
- ANY
- NONE
- REQUEST
- RESPONSE
- TOKEN
type: string
ProtocolAlgorithms:
example:
request:
signature:
scope: ANY
algorithm: algorithm
response:
signature:
scope: ANY
algorithm: algorithm
properties:
request:
$ref: '#/components/schemas/ProtocolAlgorithmType'
response:
$ref: '#/components/schemas/ProtocolAlgorithmType'
type: object
ProtocolEndpoint:
example:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
destination:
type: string
type:
$ref: '#/components/schemas/ProtocolEndpointType'
url:
type: string
type: object
ProtocolEndpointType:
enum:
- INSTANCE
- ORG
type: string
ProtocolEndpoints:
example:
acs:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
authorization:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
userInfo:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
metadata:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
jwks:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
slo:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
sso:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
token:
destination: destination
binding: HTTP-POST
type: INSTANCE
url: url
properties:
acs:
$ref: '#/components/schemas/ProtocolEndpoint'
authorization:
$ref: '#/components/schemas/ProtocolEndpoint'
jwks:
$ref: '#/components/schemas/ProtocolEndpoint'
metadata:
$ref: '#/components/schemas/ProtocolEndpoint'
slo:
$ref: '#/components/schemas/ProtocolEndpoint'
sso:
$ref: '#/components/schemas/ProtocolEndpoint'
token:
$ref: '#/components/schemas/ProtocolEndpoint'
userInfo:
$ref: '#/components/schemas/ProtocolEndpoint'
type: object
ProtocolRelayState:
example:
format: FROM_URL
properties:
format:
$ref: '#/components/schemas/ProtocolRelayStateFormat'
type: object
ProtocolRelayStateFormat:
enum:
- FROM_URL
- OPAQUE
type: string
ProtocolSettings:
example:
nameFormat: nameFormat
properties:
nameFormat:
type: string
type: object
ProtocolType:
enum:
- MTLS
- OAUTH2
- OIDC
- SAML2
type: string
ProviderType:
enum:
- APNS
- FCM
type: string
Provisioning:
description: Specifies the behavior for just-in-time (JIT) provisioning of an
IdP User as a new Okta User and their Group memberships
example:
action: AUTO
groups:
filter:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
assignments:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
sourceAttributeName: Groups
action: APPEND
profileMaster: true
conditions:
deprovisioned:
action: NONE
suspended:
action: NONE
properties:
action:
$ref: '#/components/schemas/ProvisioningAction'
conditions:
$ref: '#/components/schemas/ProvisioningConditions'
groups:
$ref: '#/components/schemas/ProvisioningGroups'
profileMaster:
description: Determines if the IdP should act as a source of truth for User
profile attributes
type: boolean
type: object
ProvisioningAction:
description: |-
Specifies the User provisioning action during authentication when an IdP User isn't linked to an existing Okta User.
* To successfully provision a new Okta User, you must enable just-in-time (JIT) provisioning in your org security settings.
* If the target username isn't unique or the resulting Okta User profile is missing a required profile attribute, JIT provisioning may fail.
* New Okta Users are provisioned with either a `FEDERATION` or `SOCIAL` authentication provider depending on the IdP type.
enum:
- AUTO
- DISABLED
type: string
x-enumDescriptions:
AUTO: The IdP User profile is transformed through defined universal directory
profile mappings to an Okta User profile and automatically provisioned as
an Okta User.
DISABLED: Okta rejects the authentication request and skips provisioning of
a new Okta User if the IdP User isn't linked to an existing Okta User.
ProvisioningConditions:
description: Conditional behaviors for an IdP User during authentication
example:
deprovisioned:
action: NONE
suspended:
action: NONE
properties:
deprovisioned:
$ref: '#/components/schemas/ProvisioningDeprovisionedCondition'
suspended:
$ref: '#/components/schemas/ProvisioningSuspendedCondition'
type: object
ProvisioningConnectionAuthScheme:
description: Defines the method of authentication
enum:
- OAUTH2
- TOKEN
- UNKNOWN
type: string
x-enumDescriptions:
TOKEN: A token is used to authenticate with the app.
OAUTH2: OAuth 2.0 is used to authenticate with the app.
UNKNOWN: "The authentication scheme used by the app isn't supported, or the\
\ app doesn't support provisioning."
ProvisioningConnectionOauthAuthScheme:
description: OAuth 2.0 is used to authenticate with the app.
enum:
- OAUTH2
type: string
ProvisioningConnectionOauthRequest:
allOf:
- $ref: '#/components/schemas/ProvisioningConnectionRequest'
- description: OAuth 2.0-based Provisioning Connection request
properties:
profile:
$ref: '#/components/schemas/ProvisioningConnectionOauthRequestProfile'
required:
- profile
title: OAuth 2.0-based connection
ProvisioningConnectionOauthRequestProfile:
properties:
authScheme:
$ref: '#/components/schemas/ProvisioningConnectionOauthAuthScheme'
clientId:
description: Only used for the Okta Org2Org (`okta_org2org`) app. The unique
client identifier for the OAuth 2.0 service app from the target org.
type: string
settings:
$ref: '#/components/schemas/Office365ProvisioningSettings'
required:
- authScheme
ProvisioningConnectionProfileOauth:
description: |
The app provisioning connection profile used to configure the method of authentication and the credentials.
Currently, token-based and OAuth 2.0-based authentication are supported.
properties:
authScheme:
$ref: '#/components/schemas/ProvisioningConnectionOauthAuthScheme'
clientId:
type: string
required:
- authScheme
ProvisioningConnectionRequest:
type: object
ProvisioningConnectionRequestAuthScheme:
enum:
- OAUTH2
- TOKEN
type: string
ProvisioningConnectionResponse:
example:
baseUrl: baseUrl
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
authorize:
hints:
allow:
- DELETE
- DELETE
guidance:
- guidance
- guidance
href: href
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
profile:
authScheme: OAUTH2
authScheme: TOKEN
status: DISABLED
properties:
authScheme:
$ref: '#/components/schemas/ProvisioningConnectionTokenAuthScheme'
baseUrl:
description: Base URL
type: string
profile:
$ref: '#/components/schemas/ProvisioningConnectionResponseProfile'
status:
$ref: '#/components/schemas/ProvisioningConnectionStatus'
_links:
$ref: '#/components/schemas/LinksSelfLifecycleAndAuthorize'
required:
- profile
- status
type: object
ProvisioningConnectionResponseProfile:
example:
authScheme: OAUTH2
properties:
authScheme:
$ref: '#/components/schemas/ProvisioningConnectionAuthScheme'
required:
- authScheme
ProvisioningConnectionStatus:
default: DISABLED
description: Provisioning Connection status
enum:
- DISABLED
- ENABLED
- UNKNOWN
type: string
x-enumDescriptions:
DISABLED: The Provisioning Connection is disabled.
ENABLED: The Provisioning Connection is enabled.
UNKNOWN: "Provisioning isn't supported by the app, or the authentication method\
\ is unknown."
ProvisioningConnectionTokenAuthScheme:
description: A token is used to authenticate with the app. This property is
only returned for the `TOKEN` authentication scheme.
enum:
- TOKEN
type: string
ProvisioningConnectionTokenRequest:
allOf:
- $ref: '#/components/schemas/ProvisioningConnectionRequest'
- description: Token-based Provisioning Connection request
properties:
baseUrl:
description: "Only used for the Zscaler 2.0 (`zscalerbyz`) app. The base\
\ URL for the Zscaler 2.0 target app, which also contains the Zscaler\
\ ID."
type: string
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
profile:
$ref: '#/components/schemas/ProvisioningConnectionTokenRequestProfile'
required:
- profile
title: Token-based connection
ProvisioningConnectionTokenRequestProfile:
properties:
authScheme:
$ref: '#/components/schemas/ProvisioningConnectionTokenAuthScheme'
token:
description: Token used to authenticate with the app
type: string
required:
- authScheme
ProvisioningDeprovisionedAction:
description: Specifies the action during authentication when an IdP User is
linked to a previously deprovisioned Okta User
enum:
- NONE
- REACTIVATE
type: string
x-enumDescriptions:
NONE: "Take no action. If an IdP User that matches a previously deprovisioned\
\ Okta User attempts to authenticate, authentication fails."
REACTIVATE: "If an IdP User that matches a previously deprovisioned Okta User\
\ attempts to authenticate, reactivate the matching User in Okta and allow\
\ the authentication attempt to proceed."
ProvisioningDeprovisionedCondition:
description: Behavior for a previously deprovisioned IdP User during authentication.
Not supported with OIDC IdPs.
example:
action: NONE
properties:
action:
$ref: '#/components/schemas/ProvisioningDeprovisionedAction'
type: object
ProvisioningGroups:
description: Provisioning settings for a User's Group memberships
example:
filter:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
assignments:
- 00gak46y5hydV6NdM0g4
- 00gak46y5hydV6NdM0g4
sourceAttributeName: Groups
action: APPEND
properties:
action:
$ref: '#/components/schemas/ProvisioningGroupsAction'
assignments:
description: List of `OKTA_GROUP` Group identifiers to add an IdP User as
a member with the `ASSIGN` action
items:
example: 00gak46y5hydV6NdM0g4
type: string
type: array
filter:
description: Allowlist of `OKTA_GROUP` Group identifiers for the `APPEND`
or `SYNC` provisioning action
items:
example: 00gak46y5hydV6NdM0g4
type: string
type: array
sourceAttributeName:
description: IdP User profile attribute name (case-insensitive) for an array
value that contains Group memberships
example: Groups
maxLength: 1024
type: string
type: object
ProvisioningGroupsAction:
description: |-
Provisioning action for the IdP User's Group memberships
| Enum | Description | Existing OKTA_GROUP Memberships | Existing APP_GROUP Memberships | Existing BUILT_IN Memberships |
| -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------ | ----------------------------- |
| `APPEND` | Adds a User to any Group defined by the IdP as a value of the `sourceAttributeName` array that matches the name of the allow listed Group defined in the `filter` | Unchanged | Unchanged | Unchanged |
| `ASSIGN` | Assigns a User to Groups defined in the `assignments` array | Unchanged | Unchanged | Unchanged |
| `NONE` | Skips processing of Group memberships | Unchanged | Unchanged | Unchanged |
| `SYNC` | Group memberships are sourced by the IdP as a value of the `sourceAttributeName` array that matches the name of the Group defined in the `filter` | Removed if not defined by the IdP in `sourceAttributeName` and matching name of the Group in `filter` | Unchanged | Unchanged |
> **Note:** Group provisioning action is processed independently from profile sourcing. You can sync Group memberships through SAML with profile sourcing disabled.
enum:
- APPEND
- ASSIGN
- NONE
- SYNC
type: string
ProvisioningSuspendedAction:
description: Specifies the action during authentication when an IdP User is
linked to a previously suspended Okta User
enum:
- NONE
- UNSUSPEND
type: string
x-enumDescriptions:
NONE: "Take no action. If an IdP User that matches a previously suspended\
\ Okta User attempts to authenticate, authentication fails."
UNSUSPEND: "If an IdP User that matches a previously suspended Okta User attempts\
\ to authenticate, unsuspend the matching User in Okta and allow the authentication\
\ attempt to proceed."
ProvisioningSuspendedCondition:
description: Behavior for a previously suspended IdP User during authentication.
Not supported with OIDC IdPs.
example:
action: NONE
properties:
action:
$ref: '#/components/schemas/ProvisioningSuspendedAction'
type: object
PushMethodKeyProtection:
description: Indicates whether you must use a hardware key store
enum:
- ANY
- HARDWARE
type: string
PushProvider:
discriminator:
mapping:
APNS: '#/components/schemas/APNSPushProvider'
FCM: '#/components/schemas/FCMPushProvider'
propertyName: providerType
example:
lastUpdatedDate: lastUpdatedDate
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: name
id: id
providerType: APNS
properties:
id:
description: Unique key for the Push Provider
readOnly: true
type: string
lastUpdatedDate:
description: Timestamp when the Push Provider was last modified
readOnly: true
type: string
name:
description: Display name of the push provider
type: string
providerType:
$ref: '#/components/schemas/ProviderType'
_links:
$ref: '#/components/schemas/LinksSelf'
title: PushProvider
type: object
RateLimitAdminNotifications:
description: ""
example:
notificationsEnabled: true
properties:
notificationsEnabled:
type: boolean
required:
- notificationsEnabled
title: RateLimitAdminNotifications
type: object
RateLimitWarningThresholdRequest:
description: ""
example:
warningThreshold: 34
properties:
warningThreshold:
description: "The threshold value (percentage) of a rate limit that, when\
\ exceeded, triggers a warning notification. By default, this value is\
\ 90 for Workforce orgs and 60 for CIAM orgs."
maximum: 90
minimum: 30
type: integer
required:
- warningThreshold
title: RateLimitWarningThreshold
type: object
RateLimitWarningThresholdResponse:
description: ""
example:
warningThreshold: 34
properties:
warningThreshold:
description: "The threshold value (percentage) of a rate limit that, when\
\ exceeded, triggers a warning notification. By default, this value is\
\ 90 for Workforce orgs and 60 for CIAM orgs."
maximum: 90
minimum: 30
type: integer
title: RateLimitWarningThreshold
type: object
Realm:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
isDefault: true
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
realmType: PARTNER
name: name
id: id
properties:
created:
description: Timestamp when the Realm was created
format: date-time
readOnly: true
type: string
id:
description: Unique key for the Realm
readOnly: true
type: string
isDefault:
description: Conveys whether the Realm is the default
readOnly: true
type: boolean
lastUpdated:
description: Timestamp when the Realm was last updated
format: date-time
readOnly: true
type: string
profile:
$ref: '#/components/schemas/RealmProfile'
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
RealmAssignment:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
isDefault: true
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
name: name
id: id
conditions:
expression:
value: value
profileSourceId: profileSourceId
priority: 0
actions:
assignUserToRealm:
realmId: realmId
status: ACTIVE
properties:
actions:
$ref: '#/components/schemas/Actions'
conditions:
$ref: '#/components/schemas/Conditions'
created:
format: date-time
readOnly: true
type: string
id:
readOnly: true
type: string
isDefault:
readOnly: true
type: boolean
lastUpdated:
format: date-time
readOnly: true
type: string
name:
type: string
priority:
type: integer
status:
$ref: '#/components/schemas/LifecycleStatus'
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
RealmProfile:
example:
realmType: PARTNER
name: name
properties:
name:
description: Name of a Realm
type: string
realmType:
description: Used to store partner users. This must be set to Partner to
access Okta's external partner portal.
enum:
- PARTNER
- DEFAULT
type: string
x-enumDescriptions:
PARTNER: Realm with external partner portal
DEFAULT: Default
required:
- name
type: object
RecoveryQuestionCredential:
description: |-
Specifies a secret question and answer that's validated (case insensitive) when a User forgets their
password or unlocks their account. The answer property is write-only.
example:
answer: se7en
question: what is your favourite movie?
properties:
answer:
description: The answer to the recovery question
example: se7en
maximum: 100
minimum: 1
type: string
writeOnly: true
question:
description: The recovery question
example: what is your favourite movie?
maximum: 100
minimum: 1
type: string
type: object
RefreshToken:
description: The refresh token
properties:
jti:
description: The refresh token ID
type: string
type: object
RegistrationInlineHook:
allOf:
- $ref: '#/components/schemas/InlineHook'
- type: object
RegistrationInlineHookCommand:
properties:
type:
enum:
- com.okta.user.profile.update
- com.okta.action.update
- com.okta.user.progressive.profile.update
type: string
type: object
RegistrationInlineHookPPData:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/RegistrationInlineHookRequest'
- properties:
data:
$ref: '#/components/schemas/RegistrationInlineHookPPData_allOf_data'
type: object
RegistrationInlineHookRequest:
discriminator:
mapping:
self.service.registration: '#/components/schemas/RegistrationInlineHookSSRData'
progressive.profile: '#/components/schemas/RegistrationInlineHookPPData'
propertyName: requestType
properties:
eventType:
description: The type of inline hook. The registration inline hook type
is `com.okta.user.pre-registration`.
type: string
requestType:
$ref: '#/components/schemas/RegistrationInlineHookRequestType'
type: object
RegistrationInlineHookRequestType:
description: The type of registration hook. Use either `self.service.registration`
or `progressive.profile`.
enum:
- progressive.profile
- self.service.registration
type: string
RegistrationInlineHookResponse:
properties:
commands:
items:
description: TODO default missing array inner type to string
type: string
type: array
type: object
RegistrationInlineHookSSRData:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/RegistrationInlineHookRequest'
- properties:
data:
$ref: '#/components/schemas/RegistrationInlineHookSSRData_allOf_data'
type: object
RegistrationResponse:
properties:
commands:
description: |-
The `commands` object lets you invoke commands to modify or add values to the attributes in the Okta user profile that are created for this user. The object also lets you control whether or not the registration attempt is allowed to proceed.
This object is an array, allowing you to send multiple commands in your response. Each array element requires a `type` property and a `value` property. The `type` property is where you specify which of the supported commands you wish to execute, and `value` is where you supply parameters for that command.
The registration inline hook supports these three commands:
* `com.okta.user.profile.update`: Change attribute values in the user's Okta user profile. For SSR only. Invalid if used with a Progressive Profile response.
* `com.okta.action.update`: Allow or deny the user's registration.
* `com.okta.user.progressive.profile.update`: Change attribute values in the user's Okta Progressive Profile.
items:
$ref: '#/components/schemas/RegistrationResponse_commands_inner'
type: array
Error:
$ref: '#/components/schemas/RegistrationResponse_Error'
type: object
ReleaseChannel:
description: Release channel for auto-update
enum:
- BETA
- EA
- GA
- TEST
type: string
RequiredEnum:
enum:
- ALWAYS
- HIGH_RISK_ONLY
- NEVER
type: string
ResendUserFactor:
discriminator:
mapping:
call: '#/components/schemas/UserFactorCall'
email: '#/components/schemas/UserFactorEmail'
sms: '#/components/schemas/UserFactorSMS'
propertyName: factorType
example:
factorType: call
properties:
factorType:
description: Type of the Factor
enum:
- call
- email
- sms
type: string
type: object
ResetPasswordToken:
example:
resetPasswordUrl: "https://{yourOktaDomain}/signin/reset-password/XE6wE17zmphl3KqAPFxO"
properties:
resetPasswordUrl:
example: "https://{yourOktaDomain}/signin/reset-password/XE6wE17zmphl3KqAPFxO"
readOnly: true
type: string
type: object
ResourceSelectorCreateRequestSchema:
properties:
description:
description: Description of the Resource Selector
type: string
filter:
description: SCIM filter of the Resource Selector
type: string
name:
description: Name of the Resource Selector
type: string
schema:
description: Schema of the Resource Selector
type: string
type: object
ResourceSelectorPatchRequestSchema:
properties:
description:
description: Description of the Resource Selector
type: string
filter:
description: SCIM filter of the Resource Selector
type: string
name:
description: Name of the Resource Selector
type: string
type: object
ResourceSelectorResponseSchema:
properties:
description:
description: Description of the Resource Selector
type: string
id:
description: Unique key for the Resource Selector
type: string
name:
description: Name of the Resource Selector
type: string
orn:
description: An Okta resource name
type: string
_links:
$ref: '#/components/schemas/ResourceSelectorResponseSchema__links'
type: object
ResourceSelectorResponseWithoutSelfLinkSchema:
properties:
description:
description: Description of the Resource Selector
type: string
id:
description: Unique key for the Resource Selector
type: string
name:
description: Name of the Resource Selector
type: string
orn:
description: An Okta resource name
type: string
_links:
$ref: '#/components/schemas/ResourceSelectorResponseWithoutSelfLinkSchema__links'
type: object
ResourceSelectorsSchema:
properties:
resourceSelectors:
items:
$ref: '#/components/schemas/ResourceSelectorResponseWithoutSelfLinkSchema'
type: array
_links:
$ref: '#/components/schemas/LinksNext'
type: object
ResourceSet:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resources:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
description: description
id: id
label: label
properties:
created:
description: Timestamp when the role was created
format: date-time
readOnly: true
type: string
description:
description: Description of the Resource Set
type: string
id:
description: Unique ID for the Resource Set object
readOnly: true
type: string
label:
description: Unique label for the Resource Set
type: string
lastUpdated:
description: Timestamp when the role was last updated
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/ResourceSet__links'
type: object
ResourceSetBindingAddMembersRequest:
example:
additions:
- additions
- additions
properties:
additions:
items:
type: string
type: array
type: object
ResourceSetBindingCreateRequest:
example:
role: role
members:
- members
- members
properties:
members:
items:
type: string
type: array
role:
description: Unique key for the role
type: string
type: object
ResourceSetBindingMember:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
id: id
properties:
created:
description: Timestamp when the role was created
format: date-time
readOnly: true
type: string
id:
description: Unique key for the role
readOnly: true
type: string
lastUpdated:
description: Timestamp when the role was last updated
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
ResourceSetBindingMembers:
example:
_links:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
binding:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
members:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
id: id
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
id: id
properties:
members:
items:
$ref: '#/components/schemas/ResourceSetBindingMember'
type: array
_links:
$ref: '#/components/schemas/ResourceSetBindingMembers__links'
type: object
ResourceSetBindingResponse:
example:
_links:
resource-set:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
properties:
id:
description: '`id` of the role'
type: string
_links:
$ref: '#/components/schemas/ResourceSetBindingResponse__links'
type: object
ResourceSetBindingRole:
example:
_links:
members:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
properties:
id:
type: string
_links:
$ref: '#/components/schemas/ResourceSetBindingRole__links'
type: object
ResourceSetBindings:
example:
_links:
resource-set:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
roles:
- _links:
members:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
- _links:
members:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
properties:
roles:
items:
$ref: '#/components/schemas/ResourceSetBindingRole'
type: array
_links:
$ref: '#/components/schemas/ResourceSetBindingResponse__links'
type: object
ResourceSetResource:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
resource:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
groups:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
orn: orn
id: id
properties:
created:
description: Timestamp when the Resource Set Resource object was created
format: date-time
readOnly: true
type: string
id:
description: Unique ID of the Resource Set Resource object
readOnly: true
type: string
lastUpdated:
description: Timestamp when this object was last updated
format: date-time
readOnly: true
type: string
orn:
description: The Okta Resource Name (ORN) of the resource
type: string
_links:
$ref: '#/components/schemas/ResourceSetResource__links'
type: object
ResourceSetResourcePatchRequest:
example:
additions:
- additions
- additions
properties:
additions:
description: A list of resources to add to the Resource Set
items:
description: Resource in ORN or REST API URL format
type: string
type: array
type: object
ResourceSetResourcePostRequest:
properties:
resourceOrnOrUrl:
description: Resource in ORN or REST API URL format
type: string
required:
- conditions
- resourceOrnOrUrl
type: object
ResourceSetResourcePutRequest:
type: object
ResourceSetResources:
example:
_links:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resource-set:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resources:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
resource:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
groups:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
orn: orn
id: id
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
resource:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
groups:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
orn: orn
id: id
properties:
resources:
items:
$ref: '#/components/schemas/ResourceSetResource'
type: array
_links:
$ref: '#/components/schemas/ResourceSetResources__links'
type: object
ResourceSets:
example:
resource-sets:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resources:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
description: description
id: id
label: label
- lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resources:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
description: description
id: id
label: label
_links:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
resource-sets:
items:
$ref: '#/components/schemas/ResourceSet'
type: array
_links:
$ref: '#/components/schemas/LinksNext'
type: object
ResponseLinks:
description: Link objects
example:
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
ResponseMode:
enum:
- form_post
- fragment
- okta_post_message
- query
type: string
x-enumDescriptions:
fragment: Parameters are encoded in the URL fragment added to the `redirect_uri`
when redirecting back to the client.
query: Parameters are encoded in the query string added to the `redirect_uri`
when redirecting back to the client.
form_post: Parameters are encoded as HTML form values (`application/x-www-form-urlencoded`
format) and are transmitted through the HTTP POST method to the client.
okta_post_message: |-
Uses [HTML5 Web Messaging](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage) (for example, `window.postMessage()`) instead of the redirect for the authorization response from the `/authorize` endpoint.
`okta_post_message` is an adaptation of the [Web Message Response Mode](https://tools.ietf.org/html/draft-sakimura-oauth-wmrm-00#section-4.1).
This value provides a secure way for a single-page application to perform a sign-in flow in a pop-up window or an iFrame and receive the ID token, access token, and/or authorization code back in the parent page without leaving the context of that page. The data object for the `postMessage` call is in the next section.
ResponseType:
enum:
- code
- id_token
- none
- token
type: string
ResponseTypesSupported:
enum:
- code
- code id_token
- code id_token token
- code token
- id_token
- id_token token
- token
type: string
RevokeRefreshTokenHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
type: string
type: object
RiscIdentifierChangedEvent:
description: "The subject's identifier has changed, which is either an email\
\ address or a phone number change"
properties:
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
new-value:
description: The new identifier value
example: new.email@okta.example.com
type: string
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- event_timestamp
- subject
type: object
RiskDetectionTypesPolicyRuleCondition:
description: "<x-lifecycle class=\"oie\"></x-lifecycle> An object that references\
\ detected risk events. This object can have an `include` parameter or an\
\ `exclude` parameter, but not both."
properties:
exclude:
description: An array of detected risk events to exclude in the entity policy
rule
items:
$ref: '#/components/schemas/DetectedRiskEvents'
type: array
include:
description: An array of detected risk events to include in the entity policy
rule
items:
$ref: '#/components/schemas/DetectedRiskEvents'
type: array
required:
- exclude
- include
type: object
RiskEvent:
example:
subjects:
- riskLevel: HIGH
ip: ip
message: message
- riskLevel: HIGH
ip: ip
message: message
expiresAt: 2000-01-23T04:56:07.000+00:00
timestamp: 2000-01-23T04:56:07.000+00:00
properties:
expiresAt:
description: "Timestamp at which the event expires (expressed as a UTC time\
\ zone using ISO 8601 format: yyyy-MM-dd`T`HH:mm:ss.SSS`Z`). If this optional\
\ field is not included, Okta automatically expires the event 24 hours\
\ after the event is consumed."
format: date-time
type: string
subjects:
description: List of Risk Event Subjects
items:
$ref: '#/components/schemas/RiskEventSubject'
type: array
timestamp:
description: "Timestamp of when the event is produced (expressed as a UTC\
\ time zone using ISO 8601 format: yyyy-MM-dd`T`HH:mm:ss.SSS`Z`)"
format: date-time
type: string
required:
- subjects
type: object
RiskEventSubject:
example:
riskLevel: HIGH
ip: ip
message: message
properties:
ip:
description: The risk event subject IP address (either an IPv4 or IPv6 address)
type: string
message:
description: Additional reasons for the risk level of the IP
maxLength: 512
pattern: "^[a-zA-Z0-9 .\\-_]*$"
type: string
riskLevel:
$ref: '#/components/schemas/RiskEventSubjectRiskLevel'
required:
- ip
- riskLevel
type: object
RiskEventSubjectRiskLevel:
description: The risk level associated with the IP
enum:
- HIGH
- LOW
- MEDIUM
type: string
RiskPolicyRuleCondition:
properties:
behaviors:
items:
type: string
type: array
uniqueItems: true
type: object
RiskProvider:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
clientId: 00cjkjjkkgjkdkjdkkljjsd
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
name: Risk-Partner-X
action: log_only
id: 00rp12r4skkjkjgsn
properties:
action:
$ref: '#/components/schemas/RiskProviderAction'
clientId:
description: "The ID of the [OAuth service app](https://developer.okta.com/docs/guides/implement-oauth-for-okta-serviceapp/main/#create-a-service-app-and-grant-scopes)\
\ that is used to send risk events to Okta"
example: 00cjkjjkkgjkdkjdkkljjsd
type: string
created:
description: Timestamp when the Risk Provider object was created
format: date-time
readOnly: true
type: string
id:
description: The ID of the Risk Provider object
example: 00rp12r4skkjkjgsn
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Risk Provider object was last updated
format: date-time
readOnly: true
type: string
name:
description: Name of the risk provider
example: Risk-Partner-X
maxLength: 50
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
required:
- _links
- action
- clientId
- id
- name
type: object
RiskProviderAction:
default: log_only
description: Action taken by Okta during authentication attempts based on the
risk events sent by this provider
enum:
- enforce_and_log
- log_only
- none
type: string
x-enumDescriptions:
log_only: Include risk event information in the System Log
none: No action
enforce_and_log: Use risk event information to evaluate risks during authentication
attempts and include risk event information in the System Log
RiskScorePolicyRuleCondition:
description: Specifies a particular level of risk to match on
properties:
level:
description: The level to match
enum:
- ANY
- LOW
- MEDIUM
- HIGH
type: string
required:
- level
type: object
Role:
properties:
assignmentType:
$ref: '#/components/schemas/RoleAssignmentType'
created:
format: date-time
readOnly: true
type: string
description:
type: string
id:
readOnly: true
type: string
label:
readOnly: true
type: string
lastUpdated:
format: date-time
readOnly: true
type: string
status:
$ref: '#/components/schemas/LifecycleStatus'
type:
$ref: '#/components/schemas/RoleType'
_embedded:
additionalProperties:
properties: {}
type: object
readOnly: true
type: object
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
RoleAssignedUser:
example:
_links:
roles:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orn: orn
id: id
properties:
id:
description: The ID of the User
readOnly: true
type: string
orn:
description: ORN representing the assignee
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelfAndRoles'
type: object
RoleAssignedUsers:
example:
_links:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
value:
- _links:
roles:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orn: orn
id: id
- _links:
roles:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orn: orn
id: id
properties:
value:
items:
$ref: '#/components/schemas/RoleAssignedUser'
type: array
_links:
$ref: '#/components/schemas/LinksNextForRoleAssignments'
type: object
RoleAssignmentType:
description: Role assignment type
enum:
- CLIENT
- GROUP
- USER
type: string
x-enumDescriptions:
USER: The Role is assigned to a User
GROUP: The Role is assigned to a Group
CLIENT: The Role is assigned to a Client Application
RoleGovernance:
description: List of all User Role Governance Sources
properties:
grants:
items:
$ref: '#/components/schemas/RoleGovernanceSource'
type: array
_links:
$ref: '#/components/schemas/LinksGovernanceSources'
type: object
RoleGovernanceResource:
description: The resource of a grant
properties:
label:
description: The resource name
type: string
resource:
description: The resources id
type: string
type: object
RoleGovernanceResources:
description: The resources of a grant
properties:
resources:
items:
$ref: '#/components/schemas/RoleGovernanceResource'
type: array
_links:
$ref: '#/components/schemas/RoleGovernanceResources__links'
type: object
RoleGovernanceSource:
description: User Role Governance Source
properties:
bundleId:
description: '`id` of the entitlement bundle'
readOnly: true
type: string
expirationDate:
description: The expiration date of the entitlement bundle
format: date-time
readOnly: true
type: string
grantId:
description: '`id` of the grant'
readOnly: true
type: string
type:
$ref: '#/components/schemas/GovernanceSourceType'
_links:
$ref: '#/components/schemas/RoleGovernanceSource__links'
required:
- grantId
- resources
- type
type: object
RolePermissionType:
description: Permission type
enum:
- okta.apps.assignment.manage
- okta.apps.manage
- okta.apps.manageFirstPartyApps
- okta.apps.read
- okta.authzServers.manage
- okta.authzServers.read
- okta.customizations.manage
- okta.customizations.read
- okta.devices.lifecycle.activate
- okta.devices.lifecycle.deactivate
- okta.devices.lifecycle.delete
- okta.devices.lifecycle.manage
- okta.devices.lifecycle.suspend
- okta.devices.lifecycle.unsuspend
- okta.devices.manage
- okta.devices.read
- okta.governance.accessCertifications.manage
- okta.governance.accessRequests.manage
- okta.groups.appAssignment.manage
- okta.groups.create
- okta.groups.manage
- okta.groups.members.manage
- okta.groups.read
- okta.identityProviders.manage
- okta.identityProviders.read
- okta.profilesources.import.run
- okta.support.cases.manage
- okta.users.appAssignment.manage
- okta.users.create
- okta.users.credentials.expirePassword
- okta.users.credentials.manage
- okta.users.credentials.resetFactors
- okta.users.credentials.resetPassword
- okta.users.groupMembership.manage
- okta.users.lifecycle.activate
- okta.users.lifecycle.clearSessions
- okta.users.lifecycle.deactivate
- okta.users.lifecycle.delete
- okta.users.lifecycle.manage
- okta.users.lifecycle.suspend
- okta.users.lifecycle.unlock
- okta.users.lifecycle.unsuspend
- okta.users.manage
- okta.users.read
- okta.users.userprofile.manage
type: string
RoleType:
description: Standard role type
enum:
- ACCESS_CERTIFICATIONS_ADMIN
- ACCESS_REQUESTS_ADMIN
- API_ACCESS_MANAGEMENT_ADMIN
- API_ADMIN
- APP_ADMIN
- CUSTOM
- GROUP_MEMBERSHIP_ADMIN
- HELP_DESK_ADMIN
- MOBILE_ADMIN
- ORG_ADMIN
- READ_ONLY_ADMIN
- REPORT_ADMIN
- SUPER_ADMIN
- USER_ADMIN
type: string
x-enumDescriptions:
API_ACCESS_MANAGEMENT_ADMIN: Access Management Administrator
API_ADMIN: Access Management Administrator
APP_ADMIN: Application Administrator
CUSTOM: Custom label specified by the client
GROUP_MEMBERSHIP_ADMIN: Group Membership Administrator
HELP_DESK_ADMIN: Help Desk Administrator
MOBILE_ADMIN: Mobile Administrator
ORG_ADMIN: Organizational Administrator
READ_ONLY_ADMIN: Read-Only Administrator
REPORT_ADMIN: Report Administrator
SUPER_ADMIN: Super Administrator
USER_ADMIN: Group Administrator
ACCESS_CERTIFICATIONS_ADMIN: Access Certifications Administrator (predefined
Resource Sets)
ACCESS_REQUESTS_ADMIN: Access Requests Administrator (predefined Resource
Sets) <x-lifecycle class="ea"></x-lifecycle>
RotatePasswordRequest:
description: Rotate password request for the privileged account
properties:
password:
description: The password associated with the privileged resource
example: xf1bs9am2
format: password
type: string
writeOnly: true
secretVersionId:
description: The version ID of the password secret from the OPA vault
example: 9f8400-e29b-41d4-a716-926655440034
maxLength: 36
minLength: 1
type: string
required:
- password
- secretVersionId
type: object
SAMLHookResponse:
properties:
commands:
description: "The `commands` object is where you tell Okta to add additional\
\ claims to the assertion or to modify the existing assertion statements.\n\
\n`commands` is an array, allowing you to send multiple commands. In each\
\ array element, include a `type` property and a `value` property. The\
\ `type` property is where you specify which of the supported commands\
\ you want to execute, and `value` is where you supply an operand for\
\ that command.\nIn the case of the SAML assertion inline hook, the `value`\
\ property is itself a nested object, in which you specify a particular\
\ operation, a path to act on, and a value. "
items:
$ref: '#/components/schemas/SAMLHookResponse_commands_inner'
type: array
error:
$ref: '#/components/schemas/SAMLHookResponse_error'
type: object
SAMLPayLoad:
properties:
data:
$ref: '#/components/schemas/SAMLPayLoad_data'
type: object
SafeBrowsingProtectionLevel:
description: Represents the current value of the Safe Browsing protection level
enum:
- ENHANCED_PROTECTION
- NO_SAFE_BROWSING
- STANDARD_PROTECTION
example: ENHANCED_PROTECTION
type: string
x-enumDescriptions:
NO_SAFE_BROWSING: Safe Browsing is never active
STANDARD_PROTECTION: Safe Browsing is active in the standard mode
ENHANCED_PROTECTION: Safe Browsing is active in the enhanced mode
SalesforceApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- salesforce
example: salesforce
type: string
signOnMode:
enum:
- BROWSER_PLUGIN
- BOOKMARK
- SAML_2_0
example: BROWSER_PLUGIN
type: string
settings:
$ref: '#/components/schemas/SalesforceApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for the Salesforce app (key name: `salesforce`)
To create a Salesforce app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Salesforce app only supports `BROWSER_PLUGIN`, `BOOKMARK`, and `SAML_2_0` sign-on modes.
example:
name: salesforce
label: Sample Salesforce App
signOnMode: SAML_2_0
settings:
app:
instanceType: SANDBOX
integrationType: STANDARD
title: Salesforce
x-tags:
- Application
x-okta-defined-as:
name: salesforce
SalesforceApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/SalesforceApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
SalesforceApplicationSettingsApplication:
description: Salesforce app instance properties
properties:
instanceType:
description: Salesforce instance that you want to connect to
enum:
- SANDBOX
- PRODUCTION
- GOVERNMENT
type: string
integrationType:
description: Salesforce integration type
enum:
- STANDARD
- PORTAL
- COMMUNITY
type: string
loginUrl:
description: The Login URL specified in your Salesforce Single Sign-On settings
type: string
logoutUrl:
description: Salesforce Logout URL
type: string
required:
- instanceType
- integrationType
type: object
Saml:
description: SAML configuration details
properties:
acs:
description: "List of Assertion Consumer Service (ACS) URLs. The default\
\ ACS URL is required and is indicated by a null `index` value. You can\
\ use the org-level variables you defined in the `config` array in the\
\ URL. For example: `https://${org.subdomain}.example.com/saml/login`"
items:
$ref: '#/components/schemas/Saml_acs_inner'
minItems: 1
type: array
claims:
description: Attribute statements to appear in the Okta SAML assertion
items:
$ref: '#/components/schemas/Saml_claims_inner'
type: array
doc:
description: "The URL to your customer-facing instructions for configuring\
\ your SAML integration. See [Customer configuration document guidelines](https://developer.okta.com/docs/guides/submit-app-prereq/main/#customer-configuration-document-guidelines)."
example: https://example.com/strawberry/help/samlSetup
format: uri
type: string
entityId:
description: "Globally unique name for your SAML entity. For instance, your\
\ Identity Provider (IdP) or Service Provider (SP) URL."
example: "https://${org.subdomain}.example.com"
type: string
groups:
description: Defines the group attribute names for the SAML assertion statement.
Okta inserts the list of Okta user groups into the attribute names in
the statement.
items:
description: A group attribute name in your SAML app
example: groups
type: string
type: array
required:
- acs
- doc
- entityId
type: object
Saml11Application:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/ApplicationCredentials'
name:
description: The key name for the SAML 1.1 app definition. You can't create
a custom SAML 1.1 app integration instance. Only existing OIN SAML 1.1
app integrations are supported.
type: string
settings:
$ref: '#/components/schemas/Saml11ApplicationSettings'
required:
- name
type: object
Saml11ApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
app:
additionalProperties: true
type: object
signOn:
$ref: '#/components/schemas/Saml11ApplicationSettingsSignOn'
type: object
Saml11ApplicationSettingsSignOn:
description: SAML 1.1 sign-on mode attributes
properties:
audienceOverride:
description: The intended audience of the SAML assertion. This is usually
the Entity ID of your application.
type: string
defaultRelayState:
description: "The URL of the resource to direct users after they successfully\
\ sign in to the SP using SAML. See the SP documentation to check if you\
\ need to specify a RelayState. In most instances, you can leave this\
\ field blank."
type: string
recipientOverride:
description: The location where the application can present the SAML assertion.
This is usually the Single Sign-On (SSO) URL.
type: string
ssoAcsUrlOverride:
description: Assertion Consumer Services (ACS) URL value for the Service
Provider (SP). This URL is always used for Identity Provider (IdP) initiated
sign-on requests.
type: string
title: SAML 1.1 settings
type: object
SamlAcsEndpoint:
description: Okta's `SPSSODescriptor` endpoint where the IdP sends a `<SAMLResponse>`
message
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
type:
$ref: '#/components/schemas/SamlEndpointType'
type: object
SamlAlgorithms:
description: Settings for signing and verifying SAML messages
properties:
request:
$ref: '#/components/schemas/SamlRequestAlgorithm'
response:
$ref: '#/components/schemas/SamlResponseAlgorithm'
type: object
SamlApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/ApplicationCredentials'
name:
description: A unique key is generated for the custom app instance when
you use SAML_2_0 `signOnMode`.
readOnly: true
type: string
settings:
$ref: '#/components/schemas/SamlApplicationSettings'
type: object
SamlApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
signOn:
$ref: '#/components/schemas/SamlApplicationSettingsSignOn'
type: object
SamlApplicationSettingsSignOn:
description: |-
SAML 2.0 sign-on attributes.
> **Note:** Set either `destinationOverride` or `ssoAcsUrl` to configure any other SAML 2.0 attributes in this section.
properties:
acsEndpoints:
description: An array of ACS endpoints. You can configure a maximum of 100
endpoints.
items:
$ref: '#/components/schemas/AcsEndpoint'
type: array
allowMultipleAcsEndpoints:
description: Determines whether the app allows you to configure multiple
ACS URIs
type: boolean
assertionSigned:
description: Determines whether the SAML assertion is digitally signed
type: boolean
attributeStatements:
description: |
A list of custom attribute statements for the app's SAML assertion. See [SAML 2.0 Technical Overview](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html).
There are two types of attribute statements:
| Type | Description |
| ---- | ----------- |
| EXPRESSION | Generic attribute statement that can be dynamic and supports [Okta Expression Language](https://developer.okta.com/docs/reference/okta-expression-language/) |
| GROUP | Group attribute statement |
items:
$ref: '#/components/schemas/SamlAttributeStatement'
type: array
audience:
description: The entity ID of the SP. Use the entity ID value exactly as
provided by the SP.
type: string
audienceOverride:
description: "Audience override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
authnContextClassRef:
description: Identifies the SAML authentication context class for the assertion's
authentication statement
type: string
configuredAttributeStatements:
description: |
The list of dynamic attribute statements for the SAML assertion inherited from app metadata (apps from the OIN) during app creation.
There are two types of attribute statements: `EXPRESSION` and `GROUP`.
items:
$ref: '#/components/schemas/SamlAttributeStatement'
type: array
defaultRelayState:
description: Identifies a specific application resource in an IdP-initiated
SSO scenario
type: string
destination:
description: Identifies the location inside the SAML assertion where the
SAML response should be sent
type: string
destinationOverride:
description: "Destination override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
digestAlgorithm:
description: Determines the digest algorithm used to digitally sign the
SAML assertion and response
type: string
honorForceAuthn:
description: Set to `true` to prompt users for their credentials when a
SAML request has the `ForceAuthn` attribute set to `true`
type: boolean
idpIssuer:
description: SAML Issuer ID
type: string
inlineHooks:
description: "Associates the app with SAML inline hooks. See [the SAML assertion\
\ inline hook reference](https://developer.okta.com/docs/reference/saml-hook/)."
items:
$ref: '#/components/schemas/SignOnInlineHook'
type: array
participateSlo:
$ref: '#/components/schemas/SloParticipate'
recipient:
description: The location where the app may present the SAML assertion
type: string
recipientOverride:
description: "Recipient override for CASB configuration. See [CASB config\
\ guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
requestCompressed:
description: Determines whether the SAML request is expected to be compressed
type: boolean
responseSigned:
description: |-
Determines whether the SAML authentication response message is digitally signed by the IdP
> **Note:** Either (or both) `responseSigned` or `assertionSigned` must be `TRUE`.
type: boolean
samlAssertionLifetimeSeconds:
description: Determines the SAML app session lifetimes with Okta
example: 3600
type: integer
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
signatureAlgorithm:
description: Determines the signing algorithm used to digitally sign the
SAML assertion and response
type: string
slo:
$ref: '#/components/schemas/SingleLogout'
spCertificate:
$ref: '#/components/schemas/SamlSpCertificate'
spIssuer:
description: The issuer ID for the Service Provider. This property appears
when SLO is enabled.
type: string
ssoAcsUrl:
description: Single Sign-On Assertion Consumer Service (ACS) URL
type: string
ssoAcsUrlOverride:
description: "Assertion Consumer Service (ACS) URL override for CASB configuration.\
\ See [CASB config guide](https://help.okta.com/en-us/Content/Topics/Apps/CASB-config-guide.htm)."
type: string
subjectNameIdFormat:
type: string
subjectNameIdTemplate:
description: Template for app user's username when a user is assigned to
the app
type: string
required:
- allowMultipleAcsEndpoints
- assertionSigned
- audience
- authnContextClassRef
- destination
- digestAlgorithm
- honorForceAuthn
- idpIssuer
- recipient
- requestCompressed
- responseSigned
- signatureAlgorithm
- ssoAcsUrl
- subjectNameIdFormat
- subjectNameIdTemplate
type: object
SamlAttributeStatement:
description: Define custom attribute statements for the integration. These statements
are inserted into the SAML assertions shared with your app
properties:
filterType:
type: string
filterValue:
type: string
name:
type: string
namespace:
type: string
type:
type: string
values:
items:
type: string
type: array
type: object
SamlCredentials:
description: Federation Trust Credentials for verifying assertions from the
IdP and signing requests to the IdP
properties:
signing:
$ref: '#/components/schemas/SamlSigningCredentials'
trust:
$ref: '#/components/schemas/SamlTrustCredentials'
type: object
SamlEndpointType:
default: INSTANCE
description: Determines whether to publish an instance-specific (trust) or organization
(shared) ACS endpoint in the SAML metadata
enum:
- INSTANCE
- ORG
type: string
SamlEndpoints:
description: SAML 2.0 HTTP binding settings for IdP and SP (Okta)
properties:
acs:
$ref: '#/components/schemas/SamlAcsEndpoint'
sso:
$ref: '#/components/schemas/SamlSsoEndpoint'
type: object
SamlNameIdFormat:
default: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
description: SAML 2.0 Name Identifier formats
enum:
- urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
- urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
- urn:oasis:names:tc:SAML:2.0:nameid-format:persistent
- urn:oasis:names:tc:SAML:2.0:nameid-format:transient
type: string
SamlRelayState:
description: Relay state settings for IdP
properties:
format:
$ref: '#/components/schemas/SamlRelayStateFormat'
type: object
SamlRelayStateFormat:
description: The format used to generate the `relayState` in the SAML request.
The `FROM_URL` format is used if this value is null.
enum:
- FROM_URL
- OPAQUE
type: string
SamlRequestAlgorithm:
description: Algorithm settings used to secure an `<AuthnRequest>` message
properties:
signature:
$ref: '#/components/schemas/SamlRequestSignatureAlgorithm'
type: object
SamlRequestSignatureAlgorithm:
description: |-
XML digital Signature Algorithm settings for signing `<AuthnRequest>` messages sent to the IdP
> **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`).
properties:
algorithm:
$ref: '#/components/schemas/SamlSigningAlgorithm'
scope:
$ref: '#/components/schemas/ProtocolAlgorithmRequestScope'
type: object
SamlResponseAlgorithm:
description: Algorithm settings for verifying `<SAMLResponse>` messages and
`<Assertion>` elements from the IdP
properties:
signature:
$ref: '#/components/schemas/SamlResponseSignatureAlgorithm'
type: object
SamlResponseSignatureAlgorithm:
description: XML digital Signature Algorithm settings for verifying `<SAMLResponse>`
messages and `<Assertion>` elements from the IdP
properties:
algorithm:
$ref: '#/components/schemas/SamlSigningAlgorithm'
scope:
$ref: '#/components/schemas/ProtocolAlgorithmResponseScope'
type: object
SamlSettings:
description: Advanced settings for the SAML 2.0 protocol
properties:
honorPersistentNameId:
default: true
description: Determines if the IdP should persist account linking when the
incoming assertion NameID format is `urn:oasis:names:tc:SAML:2.0:nameid-format:persistent`
type: boolean
nameFormat:
$ref: '#/components/schemas/SamlNameIdFormat'
type: object
SamlSigningAlgorithm:
enum:
- SHA-1
- SHA-256
example: SHA-256
type: string
SamlSigningCredentials:
description: Key used for signing requests to the IdP
properties:
kid:
description: IdP Key Credential reference to the Okta X.509 signature certificate
example: your-key-id
type: string
type: object
SamlSpCertificate:
description: The certificate that Okta uses to validate Single Logout (SLO)
requests and responses
properties:
x5c:
description: A list that contains exactly one x509 encoded certificate
items:
type: string
type: array
type: object
SamlSsoEndpoint:
description: IdP's `SingleSignOnService` endpoint where Okta sends an `<AuthnRequest>`
message
properties:
binding:
$ref: '#/components/schemas/ProtocolEndpointBinding'
destination:
description: |-
URI reference that indicates the address to which the `<AuthnRequest>` message is sent.
The `destination` property is required if request signatures are specified. See [SAML 2.0 Request Algorithm object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/IdentityProvider/#tag/IdentityProvider/operation/createIdentityProvider!path=protocol/0/algorithms/request&t=request).
example: https://idp.example.com/saml2/sso
maxLength: 512
type: string
url:
description: |-
URL of the binding-specific endpoint to send an `<AuthnRequest>` message to the IdP.
The value of `url` defaults to the same value as the `sso` endpoint if omitted during creation of a new IdP instance.
The `url` should be the same value as the `Location` attribute for a published binding in the IdP's SAML Metadata `IDPSSODescriptor`.
example: https://idp.example.com/saml2/sso
maxLength: 1014
type: string
type: object
SamlTrustCredentials:
description: Federation Trust Credentials for verifying assertions from the
IdP
properties:
audience:
description: URI that identifies the target Okta IdP instance (SP) for an
`<Assertion>`
example: https://www.okta.com/saml2/service-provider/spgv32vOnpdyeGSaiUpL
maxLength: 1024
type: string
issuer:
description: URI that identifies the issuer (IdP) of a `<SAMLResponse>`
message `<Assertion>` element
example: urn:example:idp
maxLength: 1024
type: string
kid:
description: IdP Key Credential reference to the Okta X.509 signature certificate
example: your-key-id
type: string
type: object
ScheduledUserLifecycleAction:
properties:
status:
$ref: '#/components/schemas/PolicyUserStatus'
type: object
SchemeApplicationCredentials:
allOf:
- $ref: '#/components/schemas/ApplicationCredentials'
- properties:
password:
$ref: '#/components/schemas/PasswordCredential'
revealPassword:
description: Allow users to securely see their password
type: boolean
scheme:
$ref: '#/components/schemas/ApplicationCredentialsScheme'
signing:
$ref: '#/components/schemas/ApplicationCredentialsSigning'
userName:
description: Shared username for the app
maxLength: 100
minLength: 1
type: string
type: object
Scope:
type: string
ScopeResourceHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/authorizationServers/ausain6z9zIedDCxB0h7/scopes/scpCmCCV1DpxVkCaye2X"
type: string
title:
description: Link name
example: My phone
type: string
type: object
ScreenLockType:
enum:
- BIOMETRIC
- NONE
- PASSCODE
type: string
SecurePasswordStoreApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/SchemeApplicationCredentials'
name:
description: '`template_sps` is the key name for a SWA app instance that
uses HTTP POST and doesn''t require a browser plugin'
enum:
- template_sps
type: string
settings:
$ref: '#/components/schemas/SecurePasswordStoreApplicationSettings'
required:
- name
- settings
type: object
x-okta-defined-as:
name: template_sps
SecurePasswordStoreApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
app:
$ref: '#/components/schemas/SecurePasswordStoreApplicationSettingsApplication'
type: object
SecurePasswordStoreApplicationSettingsApplication:
properties:
optionalField1:
description: Name of the optional parameter in the sign-in form
type: string
optionalField1Value:
description: Name of the optional value in the sign-in form
type: string
optionalField2:
description: Name of the optional parameter in the sign-in form
type: string
optionalField2Value:
description: Name of the optional value in the sign-in form
type: string
optionalField3:
description: Name of the optional parameter in the sign-in form
type: string
optionalField3Value:
description: Name of the optional value in the sign-in form
type: string
passwordField:
description: CSS selector for the **Password** field in the sign-in form
type: string
url:
description: The URL of the sign-in page for this app
type: string
usernameField:
description: CSS selector for the **Username** field in the sign-in form
type: string
required:
- passwordField
- url
- usernameField
type: object
SecurityEvent:
properties:
event_timestamp:
description: The time of the event (UNIX timestamp)
example: 1702448550
format: int64
type: integer
subject:
$ref: '#/components/schemas/SecurityEventSubject'
required:
- event_timestamp
- subject
type: object
SecurityEventReason:
properties:
en:
description: The event reason in English
example: Event message example
type: string
required:
- en
type: object
SecurityEventSubject:
description: The event subjects
properties:
device:
description: The device involved with the event
type: object
tenant:
description: The tenant involved with the event
type: object
user:
description: The user involved with the event
type: object
SecurityEventTokenError:
description: Error object thrown when parsing the Security Event Token
example:
err: invalid_request
description: "Failed claim validation in security event token. 'events.mediationDeviceComplianceChangeEvent.previousStatus':\
\ The field cannot be left blank"
properties:
description:
description: |
Describes the error
> **Note:** SET claim fields with underscores (snake case) are presented in camelcase. For example, `previous_status` appears as `previousStatus`.
example: "Failed claim validation in security event token. 'events.mediationDeviceComplianceChangeEvent.previousStatus':\
\ The field cannot be left blank"
type: string
err:
description: A code that describes the category of the error
enum:
- authentication_failed
- invalid_audience
- invalid_issuer
- invalid_key
- invalid_request
example: invalid_request
type: string
title: Security Event Token Error
type: object
SecurityEventTokenRequestJwtBody:
description: JSON Web Token body payload for a Security Event Token
properties:
aud:
description: Audience
example: https://receiverexample.okta.com/
type: string
events:
$ref: '#/components/schemas/SecurityEventTokenRequestJwtEvents'
iat:
description: Token issue time (UNIX timestamp)
example: 1702448550
format: int64
type: integer
iss:
description: Token issuer
example: https://transmitter.example.com
type: string
jti:
description: Token ID
example: 24c63fb56f ... a9fa24
type: string
required:
- aud
- events
- iat
- iss
- jti
title: Security Event Token JWT body payload
type: object
x-tags:
- SSFSecurityEventToken
SecurityEventTokenRequestJwtEvents:
description: A non-empty collection of events
properties:
https://schemas.okta.com/secevent/okta/event-type/device-risk-change:
$ref: '#/components/schemas/OktaDeviceRiskChangeEvent'
https://schemas.okta.com/secevent/okta/event-type/ip-change:
$ref: '#/components/schemas/OktaIpChangeEvent'
https://schemas.okta.com/secevent/okta/event-type/user-risk-change:
$ref: '#/components/schemas/OktaUserRiskChangeEvent'
https://schemas.openid.net/secevent/caep/event-type/device-compliance-change:
$ref: '#/components/schemas/CaepDeviceComplianceChangeEvent'
https://schemas.openid.net/secevent/caep/event-type/session-revoked:
$ref: '#/components/schemas/CaepSessionRevokedEvent'
https://schemas.openid.net/secevent/risc/event-type/identifier-changed:
$ref: '#/components/schemas/RiscIdentifierChangedEvent'
type: object
SecurityEventTokenRequestJwtHeader:
description: JSON Web Token header for a Security Event Token
properties:
alg:
description: Algorithm used to sign or encrypt the JWT
example: RS256
type: string
kid:
description: Key ID used to sign or encrypt the JWT
type: string
typ:
description: The type of content being signed or encrypted
example: secevent+jwt
type: string
required:
- alg
- kid
- typ
title: Security Event Token JWT header
type: object
x-tags:
- SSFSecurityEventToken
SecurityEventsProviderRequest:
description: The request schema for creating or updating a Security Events Provider.
The `settings` must match one of the schemas.
example:
settings:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
name: Target SSF Provider
type: okta
properties:
name:
description: The name of the Security Events Provider instance
example: Target SSF Provider
maxLength: 100
type: string
settings:
$ref: '#/components/schemas/SecurityEventsProviderRequest_settings'
type:
description: The application type of the Security Events Provider
example: okta
maxLength: 255
type: string
required:
- name
- settings
- type
title: Security Events Provider Request
type: object
SecurityEventsProviderResponse:
description: The Security Events Provider response
example:
settings:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
issuer: example.okta.com
jwks_url: https://example.okta.com/oauth2/v1/keys
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: Target SSF Provider
id: sse1qg25RpusjUP6m0g5
type: okta
status: ACTIVE
properties:
id:
description: The unique identifier of this instance
example: sse1qg25RpusjUP6m0g5
readOnly: true
type: string
name:
description: The name of the Security Events Provider instance
example: Target SSF Provider
maxLength: 100
type: string
settings:
$ref: '#/components/schemas/SecurityEventsProviderSettingsResponse'
status:
description: Indicates whether the Security Events Provider is active or
not
enum:
- ACTIVE
- INACTIVE
readOnly: true
type: string
type:
description: The application type of the Security Events Provider
example: okta
maxLength: 255
type: string
_links:
$ref: '#/components/schemas/LinksSelfAndLifecycle'
title: Security Events Provider Response
type: object
SecurityEventsProviderSettingsNonSSFCompliant:
description: Security Events Provider with issuer and JWKS settings for signal
ingestion
properties:
issuer:
description: Issuer URL
example: example.okta.com
maxLength: 700
type: string
jwks_url:
description: The public URL where the JWKS public key is uploaded
example: https://example.okta.com/oauth2/v1/keys
format: url
maxLength: 1000
type: string
required:
- issuer
- jwks_url
title: Provider with issuer and JWKS settings
type: object
SecurityEventsProviderSettingsResponse:
description: Security Events Provider settings
example:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
issuer: example.okta.com
jwks_url: https://example.okta.com/oauth2/v1/keys
properties:
issuer:
description: Issuer URL
example: example.okta.com
maxLength: 700
type: string
jwks_url:
description: The public URL where the JWKS public key is uploaded
example: https://example.okta.com/oauth2/v1/keys
format: url
maxLength: 1000
type: string
well_known_url:
description: The well-known URL of the Security Events Provider (the SSF
transmitter)
example: https://example.okta.com/.well-known/ssf-configuration
format: url
maxLength: 1000
nullable: true
type: string
title: Security Events Provider settings
type: object
SecurityEventsProviderSettingsSSFCompliant:
description: Security Events Provider with well-known URL setting
example:
well_known_url: https://example.okta.com/.well-known/ssf-configuration
properties:
well_known_url:
description: The published well-known URL of the Security Events Provider
(the SSF transmitter)
example: https://example.okta.com/.well-known/ssf-configuration
format: url
maxLength: 1000
type: string
required:
- well_known_url
title: Provider with well-known URL setting
type: object
SeedEnum:
default: RANDOM
description: Determines whether the generated password is the user's Okta password
or a randomly generated password
enum:
- OKTA
- RANDOM
example: OKTA
type: string
SelfServicePasswordResetAction:
description: Enables or disables users to reset their own password and defines
the authenticators and constraints needed to complete the reset
properties:
access:
$ref: '#/components/schemas/PolicyAccess'
requirement:
$ref: '#/components/schemas/SsprRequirement'
type:
description: <x-lifecycle class="oie"></x-lifecycle> The type of rule action
enum:
- selfServicePasswordReset
type: string
type: object
Session:
example:
createdAt: 2000-01-23T04:56:07.000+00:00
lastFactorVerification: 2000-01-23T04:56:07.000+00:00
idp:
id: id
type: ACTIVE_DIRECTORY
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
amr:
- fpt
- fpt
id: id
login: login
userId: userId
expiresAt: 2000-01-23T04:56:07.000+00:00
lastPasswordVerification: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
properties:
amr:
description: Authentication method reference
items:
$ref: '#/components/schemas/SessionAuthenticationMethod'
readOnly: true
type: array
createdAt:
format: date-time
readOnly: true
type: string
expiresAt:
description: A timestamp when the Session expires
format: date-time
readOnly: true
type: string
id:
description: A unique key for the Session
readOnly: true
type: string
idp:
$ref: '#/components/schemas/SessionIdentityProvider'
lastFactorVerification:
description: A timestamp when the user last performed multifactor authentication
format: date-time
readOnly: true
type: string
lastPasswordVerification:
description: A timestamp when the user last performed the primary or step-up
authentication with a password
format: date-time
readOnly: true
type: string
login:
description: A unique identifier for the user (username)
readOnly: true
type: string
status:
$ref: '#/components/schemas/SessionStatus'
userId:
description: A unique key for the user
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
SessionAuthenticationMethod:
enum:
- fpt
- geo
- hwk
- kba
- mca
- mfa
- otp
- pwd
- sc
- sms
- swk
- tel
type: string
x-enumDescriptions:
pwd: Password authentication. **Inline hook value:** `PASSWORD` **Example:**
Standard password-based sign-in
swk: Proof-of-possession (PoP) of a software key. **Inline hook value:** `POP_SOFTWARE_KEY`
**Example:** Okta Verify with Push
hwk: Proof-of-possession (PoP) of a hardware key. **Inline hook value:** `POP_HARDWARE_KEY`
**Example:** Yubikey factor
opt: "One-time password. **Inline hook value:** `ONE_TIME_PASSWORD`. **Example:**\
\ Okta Verify, Google Authenticator"
sms: SMS text message to the user at a registered number. **Inline hook value:**
`SMS_MESSAGE`. **Example:** SMS factor
tel: Telephone call to the user at a registered number. **Inline hook value:**
`TELEPHONE_CALL`. **Example:** Phone call factor
geo: Use of geo-location information. **Inline hook value:** `GEOLOCATION`.
**Example:** IP Trust and Network Zone policy conditions
fpt: Fingerprint biometric authentication. **Inline hook value:** `BIO_FINGERPRINT`.
**Example:** Okta Verify with Touch ID
kba: Knowledge-based authentication. **Inline hook value:** `KNOWLEDGE_BASED_AUTHENTICATION`.
**Example:** Security Question factor
mfa: Multifactor authentication. **Inline hook value:** `MULTIFACTOR_AUTHENTICATION`.
**Example:** This value is present whenever any MFA factor verification
is performed.
mca: "Multiple-channel authentication. **Inline hook value:** `MULTIPLE_CHANNEL_AUTHENTICATION`.\
\ **Example:** Authentication requires communication over more than one\
\ channel, such as Internet and mobile network"
sc: "Smart card authentication. **Inline hook value:** `SMART_CARD. **Example:**\
\ User authenticated using a smart card, such as a Personal Identity Verification\
\ (PIV) card or Common Access Card (CAC)"
SessionIdentityProvider:
example:
id: id
type: ACTIVE_DIRECTORY
properties:
id:
description: "Identity Provider ID. If the `type` is `OKTA`, then the `id`\
\ is the org ID."
readOnly: true
type: string
type:
$ref: '#/components/schemas/SessionIdentityProviderType'
type: object
SessionIdentityProviderType:
enum:
- ACTIVE_DIRECTORY
- FEDERATION
- LDAP
- OKTA
- SOCIAL
type: string
SessionStatus:
enum:
- ACTIVE
- MFA_ENROLL
- MFA_REQUIRED
type: string
x-enumDescriptions:
ACTIVE: The Session is established and fully validated.
MFA_REQUIRED: "The Session is established, but requires second factor verification."
MFA_ENROLL: "The Session is established, but the user needs to enroll a second\
\ factor."
ShowSignInWithOV:
description: Controls whether to show the Sign in with Okta Verify button on
the Sign-In Widget
enum:
- ALWAYS
- NEVER
type: string
SignInPage:
allOf:
- $ref: '#/components/schemas/CustomizablePage'
- properties:
contentSecurityPolicySetting:
$ref: '#/components/schemas/ContentSecurityPolicySetting'
widgetCustomizations:
$ref: '#/components/schemas/SignInPage_allOf_widgetCustomizations'
widgetVersion:
$ref: '#/components/schemas/Version'
type: object
example:
contentSecurityPolicySetting:
mode: enforced
reportUri: reportUri
srcList:
- srcList
- srcList
widgetVersion: null
pageContent: pageContent
widgetCustomizations:
usernameInfoTip: usernameInfoTip
showUserIdentifier: true
customLink1Url: customLink1Url
customLink2Url: customLink2Url
classicRecoveryFlowEmailOrUsernameLabel: classicRecoveryFlowEmailOrUsernameLabel
customLink1Label: customLink1Label
passwordInfoTip: passwordInfoTip
forgotPasswordLabel: forgotPasswordLabel
showPasswordVisibilityToggle: true
authenticatorPageCustomLinkLabel: authenticatorPageCustomLinkLabel
unlockAccountLabel: unlockAccountLabel
helpUrl: helpUrl
unlockAccountUrl: unlockAccountUrl
usernameLabel: usernameLabel
signInLabel: signInLabel
customLink2Label: customLink2Label
authenticatorPageCustomLinkUrl: authenticatorPageCustomLinkUrl
passwordLabel: passwordLabel
forgotPasswordUrl: forgotPasswordUrl
helpLabel: helpLabel
widgetGeneration: G2
SignInPageTouchPointVariant:
description: |
Variant for the Okta sign-in page. You can publish a theme for sign-in page with different combinations of assets. Variants are preset combinations of those assets.
> **Note:** For a non-`OKTA_DEFAULT` variant, `primaryColorHex` is used for button background color and `primaryColorContrastHex` is used to optimize the opacity for button text.
enum:
- BACKGROUND_IMAGE
- BACKGROUND_SECONDARY_COLOR
- OKTA_DEFAULT
type: string
x-enumDescriptions:
BACKGROUND_IMAGE: "Uses the logo, favicon, and background image from the Theme"
BACKGROUND_SECONDARY_COLOR: Uses the logo and favicon from the Theme. Uses
`secondaryColorHex` as the background color for the Okta sign-in page.
OKTA_DEFAULT: Uses the Okta logo and favicon with no background image. Uses
the Okta colors on the Okta sign-in page.
SignOnInlineHook:
properties:
id:
readOnly: false
type: string
SigningAlgorithm:
enum:
- ES256
- ES384
- ES512
- HS256
- HS384
- HS512
- RS256
- RS384
- RS512
type: string
SimulatePolicyBody:
description: The request body required for a simulate policy operation
example:
policyContext:
ip: ip
groups:
ids:
- ids
- ids
risk:
level: LOW
zones:
ids:
- ids
- ids
device:
managed: true
registered: true
platform: platform
assuranceId: assuranceId
user:
id: id
policyTypes:
- ACCESS_POLICY
- ACCESS_POLICY
appInstance: appInstance
properties:
appInstance:
description: The application instance ID for a simulate operation
type: string
policyContext:
$ref: '#/components/schemas/PolicyContext'
policyTypes:
description: "Supported policy types for a simulate operation. The default\
\ value, `null`, returns all types."
items:
$ref: '#/components/schemas/PolicyTypeSimulation'
type: array
required:
- appInstance
type: object
SimulatePolicyEvaluations:
example:
result:
policies:
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
policyType:
- ACCESS_POLICY
- ACCESS_POLICY
evaluated:
policies:
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
status: null
undefined:
policies:
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
properties:
evaluated:
$ref: '#/components/schemas/SimulatePolicyEvaluations_evaluated'
policyType:
description: The policy type of the simulate operation
items:
$ref: '#/components/schemas/PolicyTypeSimulation'
type: array
result:
$ref: '#/components/schemas/SimulatePolicyResult'
status:
$ref: '#/components/schemas/SimulateResultStatus'
undefined:
$ref: '#/components/schemas/SimulatePolicyEvaluations_undefined'
type: object
SimulatePolicyResponse:
description: The response body returned for a simulate policy operation. An
array of `evaluations`.
items:
$ref: '#/components/schemas/SimulatePolicyEvaluations'
type: array
SimulatePolicyResult:
description: The result of the policy evaluation
example:
policies:
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
properties:
policies:
items:
$ref: '#/components/schemas/SimulateResultPoliciesItems'
type: array
type: object
SimulateResultConditions:
example:
type: type
status: MATCH
properties:
status:
$ref: '#/components/schemas/SimulateResultStatus'
type:
description: The type of condition
type: string
type: object
SimulateResultPolicies:
items:
$ref: '#/components/schemas/SimulateResultPoliciesItems'
type: array
SimulateResultPoliciesItems:
example:
name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
properties:
conditions:
description: List of all conditions involved for this policy evaluation
items:
$ref: '#/components/schemas/SimulateResultConditions'
type: array
id:
description: ID of the specified policy type
type: string
name:
description: Policy name
type: string
rules:
items:
$ref: '#/components/schemas/SimulateResultRules'
type: array
status:
$ref: '#/components/schemas/SimulateResultStatus'
type: object
SimulateResultRules:
example:
name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
properties:
conditions:
description: List of all conditions involved for this rule evaluation
items:
$ref: '#/components/schemas/SimulateResultConditions'
type: array
id:
description: The unique ID number of the policy rule
type: string
name:
description: The name of the policy rule
type: string
status:
$ref: '#/components/schemas/SimulateResultStatus'
type: object
SimulateResultStatus:
description: The result of this entity evaluation
enum:
- MATCH
- NOT_MATCH
- UNDEFINED
type: string
SingleLogout:
description: Determines if the app supports Single Logout (SLO)
properties:
enabled:
description: Whether the application supports SLO
type: boolean
issuer:
description: The issuer of the Service Provider that generates the SLO request
type: string
logoutUrl:
description: The location where the logout response is sent
type: string
type: object
SlackApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- slack
example: slack
type: string
signOnMode:
enum:
- BROWSER_PLUGIN
- SAML_2_0
type: string
settings:
$ref: '#/components/schemas/SlackApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for the Slack app (key name: `slack`)
To create a Slack app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Slack app only supports `BROWSER_PLUGIN` and `SAML_2_0` sign-on modes.
example:
name: slack
label: Sample Slack App
signOnMode: SAML_2_0
settings:
app:
domain: my-company-domain
title: Slack
x-tags:
- Application
x-okta-defined-as:
name: slack
SlackApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/SlackApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
SlackApplicationSettingsApplication:
description: Slack app instance properties
properties:
domain:
description: The Slack app domain name
type: string
userEmailValue:
description: The `User.Email` attribute value
type: string
required:
- domain
type: object
SloParticipate:
description: Determines if the app participates in Single Logout (SLO)
properties:
bindingType:
description: Request binding type
enum:
- POST
- REDIRECT
type: string
enabled:
description: Indicates whether the app is allowed to participate in front-channel
SLO
type: boolean
logoutRequestUrl:
description: URL where Okta sends the logout request
type: string
sessionIndexRequired:
description: Determines whether Okta sends the `SessionIndex` elements in
the logout request
type: boolean
type: object
SmsTemplate:
example:
template: template
lastUpdated: 2000-01-23T04:56:07.000+00:00
created: 2000-01-23T04:56:07.000+00:00
translations: "{}"
name: name
id: id
type: SMS_VERIFY_CODE
properties:
created:
format: date-time
readOnly: true
type: string
id:
readOnly: true
type: string
lastUpdated:
format: date-time
readOnly: true
type: string
name:
description: Human-readable name of the Template
maxLength: 50
minLength: 1
type: string
template:
description: "Text of the Template, including any [macros](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Template/)"
maxLength: 161
minLength: 1
type: string
translations:
description: |
- Template translations are optionally provided when you want to localize the SMS messages. Translations are provided as an object that contains `key:value` pairs: the language and the translated Template text. The key portion is a two-letter country code that conforms to [ISO 639-1](https://www.loc.gov/standards/iso639-2/php/code_list.php). The value is the translated SMS Template.
- Just like with regular SMS Templates, the length of the SMS message can't exceed 160 characters.
type: object
x-okta-extensible: true
type:
$ref: '#/components/schemas/SmsTemplateType'
type: object
SmsTemplateTranslations:
description: |
- Template translations are optionally provided when you want to localize the SMS messages. Translations are provided as an object that contains `key:value` pairs: the language and the translated Template text. The key portion is a two-letter country code that conforms to [ISO 639-1](https://www.loc.gov/standards/iso639-2/php/code_list.php). The value is the translated SMS Template.
- Just like with regular SMS Templates, the length of the SMS message can't exceed 160 characters.
type: object
x-okta-extensible: true
SmsTemplateType:
description: Type of the Template
enum:
- SMS_VERIFY_CODE
maxLength: 50
minLength: 1
type: string
SocialAuthToken:
description: The Social Authentication Token object provides the tokens and
associated metadata provided by social providers during social authentication.
example:
id: NXp9GaX1eOA-XVF_H9fn2Q
scopes:
- openid
- foo
tokenType: urn:ietf:params:oauth:token-type:access_token
expiresAt: 2016-01-03T18:15:47Z
tokenAuthScheme: Bearer
token: JBTWGV22G4ZGKV3N
properties:
expiresAt:
description: Timestamp when the object expires
example: 2016-01-03T18:15:47Z
format: date-time
readOnly: true
type: string
id:
description: Unique identifier for the token
example: NXp9GaX1eOA-XVF_H9fn2Q
readOnly: true
type: string
scopes:
description: The scopes that the token is good for
example:
- openid
- foo
items:
type: string
readOnly: true
type: array
token:
description: The raw token
example: JBTWGV22G4ZGKV3N
readOnly: true
type: string
tokenAuthScheme:
description: The token authentication scheme as defined by the social provider
example: Bearer
readOnly: true
type: string
tokenType:
description: "The type of token defined by the [OAuth Token Exchange Spec](https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-07#section-3)"
example: urn:ietf:params:oauth:token-type:access_token
readOnly: true
type: string
type: object
SourceLinks:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
schema:
$ref: '#/components/schemas/SourceLinks_allOf_schema'
type: object
example:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
SplunkEdition:
description: Edition of the Splunk Cloud instance
enum:
- aws
- aws_govcloud
- gcp
example: aws
type: string
SplunkHost:
description: "The domain name for your Splunk Cloud instance. Don't include\
\ `http` or `https` in the string. For example: `acme.splunkcloud.com`"
example: acme.splunkcloud.com
maxLength: 116
minLength: 17
type: string
SplunkToken:
description: "The HEC token for your Splunk Cloud HTTP Event Collector. The\
\ token value is set at object creation, but isn't returned."
example: 11111111-1111-2222-2222-222222222222
pattern: "(?i)^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$"
type: string
writeOnly: true
Sso:
description: "Supported SSO protocol configurations. You must configure at least\
\ one protocol: `oidc` or `saml`"
properties:
oidc:
$ref: '#/components/schemas/Oidc'
saml:
$ref: '#/components/schemas/Saml'
type: object
SsprPrimaryRequirement:
description: Defines the authenticators permitted for the initial authentication
step of password recovery
properties:
methodConstraints:
description: "Constraints on the values specified in the `methods` array.\
\ Specifying a constraint limits methods to specific authenticator(s).\
\ Currently, Google OTP is the only accepted constraint."
items:
$ref: '#/components/schemas/AuthenticatorMethodConstraint'
type: array
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: true
methods:
description: Authenticator methods allowed for the initial authentication
step of password recovery. Method `otp` requires a constraint limiting
it to a Google authenticator.
items:
enum:
- push
- sms
- voice
- email
- otp
type: string
type: array
type: object
SsprRequirement:
description: <x-lifecycle class="oie"></x-lifecycle> Describes the initial and
secondary authenticator requirements a user needs to reset their password
properties:
accessControl:
description: "Determines which authentication requirements a user needs\
\ to perform self-service operations. `AUTH_POLICY` defers conditions\
\ and authentication requirements to the [Okta account management policy](https://developer.okta.com/docs/guides/okta-account-management-policy/main/).\
\ `LEGACY` refers to the requirements described by this rule."
enum:
- AUTH_POLICY
- LEGACY
type: string
primary:
$ref: '#/components/schemas/SsprPrimaryRequirement'
stepUp:
$ref: '#/components/schemas/SsprStepUpRequirement'
type: object
SsprStepUpRequirement:
description: |-
Defines the secondary authenticators needed for password reset if `required` is true. The following are three valid configurations:
* `required`=false
* `required`=true with no methods to use any SSO authenticator
* `required`=true with `security_question` as the method
properties:
methods:
description: Authenticator methods required for secondary authentication
step of password recovery. Specify this value only when `required` is
true and `security_question` is permitted for the secondary authentication.
items:
enum:
- security_question
type: string
type: array
required:
type: boolean
type: object
StandardRole:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
targets:
catalog:
apps:
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
groups:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
- lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
_links:
assignee:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
id: id
label: label
type: ACCESS_CERTIFICATIONS_ADMIN
assignmentType: CLIENT
status: ""
properties:
assignmentType:
$ref: '#/components/schemas/RoleAssignmentType'
created:
description: Timestamp when the object was created
format: date-time
readOnly: true
type: string
id:
description: Role Assignment ID
readOnly: true
type: string
label:
description: Label for the Role Assignment
readOnly: true
type: string
lastUpdated:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
status:
allOf:
- $ref: '#/components/schemas/LifecycleStatus'
- description: Status of the Role Assignment
type:
$ref: '#/components/schemas/RoleType'
_embedded:
$ref: '#/components/schemas/StandardRole__embedded'
_links:
$ref: '#/components/schemas/LinksAssignee'
title: Standard Role Assignment
type: object
StandardRoleAssignmentSchema:
properties:
type:
description: "Specify the standard or IAM-based role type. See [standard\
\ roles](/openapi/okta-management/guides/roles/#standard-roles)."
type: string
title: Standard Role
type: object
StreamConfiguration:
example:
aud: https://example.com
delivery:
endpoint_url: https://example.com/
method: https://schemas.openid.net/secevent/risc/delivery-method/push
authorization_header: "{authorizationHeaderValue}"
events_supported:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
stream_id: esc1k235GIIztAuGK0g5
format: iss_sub
iss: "https://{yourOktaDomain}"
events_delivered:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
events_requested:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
min_verification_interval: 60
properties:
aud:
$ref: '#/components/schemas/StreamConfiguration_aud'
delivery:
$ref: '#/components/schemas/StreamConfigurationDelivery'
events_delivered:
description: |-
The events (mapped by the array of event type URIs) that the transmitter actually delivers to the SSF Stream.
A read-only parameter that is set by the transmitter. If this parameter is included in the request, the value must match the expected value from the transmitter.
example:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
items:
format: uri
type: string
type: array
events_requested:
description: The events (mapped by the array of event type URIs) that the
receiver wants to receive
example:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
items:
format: uri
maxLength: 256
type: string
maxItems: 50
type: array
events_supported:
description: |-
An array of event type URIs that the transmitter supports.
A read-only parameter that is set by the transmitter. If this parameter is included in the request, the value must match the expected value from the transmitter.
example:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
items:
format: uri
type: string
type: array
format:
description: The Subject Identifier format expected for any SET transmitted.
enum:
- iss_sub
type: string
iss:
description: |-
The issuer used in Security Event Tokens (SETs). This value is set as `iss` in the claim.
A read-only parameter that is set by the transmitter. If this parameter is included in the request, the value must match the expected value from the transmitter.
example: "https://{yourOktaDomain}"
type: string
min_verification_interval:
description: |-
The minimum amount of time, in seconds, between two verification requests.
A read-only parameter that is set by the transmitter. If this parameter is included in the request, the value must match the expected value from the transmitter.
example: 60
nullable: true
type: integer
stream_id:
description: The ID of the SSF Stream configuration
example: esc1k235GIIztAuGK0g5
type: string
required:
- delivery
- events_requested
title: Stream Configuration
type: object
StreamConfigurationCreateRequest:
example:
delivery:
endpoint_url: https://example.com/
method: https://schemas.openid.net/secevent/risc/delivery-method/push
authorization_header: "{authorizationHeaderValue}"
format: iss_sub
events_requested:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
properties:
delivery:
$ref: '#/components/schemas/StreamConfigurationDelivery'
events_requested:
description: The events (mapped by the array of event type URIs) that the
receiver wants to receive
example:
- https://schemas.openid.net/secevent/caep/event-type/session-revoked
- https://schemas.openid.net/secevent/caep/event-type/credential-change
items:
format: uri
maxLength: 256
type: string
maxItems: 50
type: array
format:
description: The Subject Identifier format expected for any SET transmitted.
enum:
- iss_sub
type: string
required:
- delivery
- events_requested
title: Stream Configuration Create Request
type: object
StreamConfigurationDelivery:
description: Contains information about the intended SET delivery method by
the receiver
example:
endpoint_url: https://example.com/
method: https://schemas.openid.net/secevent/risc/delivery-method/push
authorization_header: "{authorizationHeaderValue}"
properties:
authorization_header:
description: The HTTP Authorization header that is included for each HTTP
POST request
example: "{authorizationHeaderValue}"
maxLength: 8192
nullable: true
type: string
endpoint_url:
description: The target endpoint URL where the transmitter delivers the
SET using HTTP POST requests
example: https://example.com/
format: uri
maxLength: 2048
type: string
method:
description: The delivery method that the transmitter uses for delivering
a SET
enum:
- https://schemas.openid.net/secevent/risc/delivery-method/push
- urn:ietf:rfc:8935
type: string
required:
- endpoint_url
- method
title: Stream Configuration Delivery
type: object
SubjectType:
enum:
- pairwise
- public
type: string
SubmissionRequest:
allOf:
- $ref: '#/components/schemas/SubmissionResponse'
required:
- description
- logo
- name
SubmissionResponse:
properties:
config:
description: "List of org-level variables for the customer per-tenant configuration.\
\ For example, a `subdomain` variable can be used in the ACS URL: `https://${org.subdomain}.example.com/saml/login`"
items:
$ref: '#/components/schemas/SubmissionResponse_config_inner'
type: array
description:
description: A general description of your application and the benefits
provided to your customers
example: Your one source for in-season strawberry deals. Okta's Strawberry
Central integration allow users to securely access those sweet deals.
maxLength: 1024
minLength: 1
type: string
id:
description: OIN Integration ID
example: acme_submissionapp_1
readOnly: true
type: string
lastPublished:
description: Timestamp when the OIN Integration was last published
example: 2023-08-24T14:15:22.000Z
readOnly: true
type: string
lastUpdated:
description: Timestamp when the OIN Integration instance was last updated
example: 2023-08-24T14:15:22.000Z
readOnly: true
type: string
lastUpdatedBy:
description: ID of the user who made the last update
example: 00ub0oNGTSWTBKOLGLNR
readOnly: true
type: string
logo:
description: "URL to an uploaded application logo. This logo appears next\
\ to your app integration name in the OIN catalog. You must first [Upload\
\ an OIN Integration logo](/openapi/okta-management/management/tag/YourOinIntegrations/#tag/YourOinIntegrations/operation/uploadSubmissionLogo)\
\ to obtain the logo URL before you can specify this value."
example: https://acme.okta.com/bc/image/fileStoreRecord?id=fs03xxd3KmkDBwJU80g4
format: uri
type: string
name:
description: The app integration name. This is the main title used for your
integration in the OIN catalog.
example: Strawberry Central
maxLength: 64
minLength: 1
type: string
sso:
$ref: '#/components/schemas/Sso'
status:
description: Status of the OIN Integration submission
example: New
readOnly: true
type: string
type: object
Subscription:
example:
channels:
- channels
- channels
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
notificationType: AD_AGENT
status: subscribed
properties:
channels:
description: |-
An array of sources send notifications to users.
> **Note**: Currently, Okta only allows `email` channels.
items:
type: string
type: array
notificationType:
$ref: '#/components/schemas/NotificationType'
status:
$ref: '#/components/schemas/SubscriptionStatus'
_links:
$ref: '#/components/schemas/Subscription__links'
type: object
SubscriptionStatus:
description: The status of the subscription
enum:
- subscribed
- unsubscribed
type: string
SupportedMethods:
description: The supported methods of an Authenticator
example:
settings:
algorithms:
- ES256
- ES256
transactionTypes:
- CIBA
- CIBA
keyProtection: ANY
type: push
status: ACTIVE
properties:
settings:
$ref: '#/components/schemas/SupportedMethods_settings'
status:
$ref: '#/components/schemas/LifecycleStatus'
type:
description: The type of authenticator method
enum:
- push
type: string
type: object
SwaApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
app:
$ref: '#/components/schemas/SwaApplicationSettingsApplication'
type: object
SwaApplicationSettingsApplication:
properties:
buttonField:
description: CSS selector for the **Sign-In** button in the sign-in form
(for SWA apps with the `template_swa` app name definition)
type: string
buttonSelector:
description: CSS selector for the **Sign-In** button in the sign-in form
(for three-field SWA apps with the `template_swa3field` app name definition)
type: string
extraFieldSelector:
description: Enter the CSS selector for the extra field (for three-field
SWA apps with the `template_swa3field` app name definition).
type: string
extraFieldValue:
description: Enter the value for the extra field in the form (for three-field
SWA apps with the `template_swa3field` app name definition).
type: string
loginUrlRegex:
description: A regular expression that further restricts targetURL to the
specified regular expression
type: string
passwordField:
description: CSS selector for the **Password** field in the sign-in form
(for SWA apps with the `template_swa` app name definition)
type: string
passwordSelector:
description: CSS selector for the **Password** field in the sign-in form
(for three-field SWA apps with the `template_swa3field` app name definition)
type: string
targetURL:
description: The URL of the sign-in page for this app (for three-field SWA
apps with the `template_swa3field` app name definition)
type: string
url:
description: The URL of the sign-in page for this app (for SWA apps with
the `template_swa` app name definition)
type: string
usernameField:
description: CSS selector for the **Username** field in the sign-in form
(for SWA apps with the `template_swa` app name definition)
type: string
userNameSelector:
description: CSS selector for the **Username** field in the sign-in form
(for three-field SWA apps with the `template_swa3field` app name definition)
type: string
required:
- buttonField
- passwordField
- url
- usernameField
type: object
TelephonyRequest:
properties:
data:
$ref: '#/components/schemas/TelephonyRequestData'
eventType:
description: The type of inline hook. The Telephony inline hook type is
`com.okta.telephony.provider`.
type: string
requestType:
description: "The type of inline hook request. For example, `com.okta.user.telephony.pre-enrollment`."
type: string
source:
description: The ID and URL of the Telephony inline hook
type: string
type: object
TelephonyRequestData:
properties:
context:
$ref: '#/components/schemas/RegistrationInlineHookSSRData_allOf_data_context'
messageProfile:
$ref: '#/components/schemas/TelephonyRequestData_messageProfile'
userProfile:
$ref: '#/components/schemas/TelephonyRequestData_userProfile'
type: object
TelephonyResponse:
properties:
commands:
description: "The `commands` object specifies whether Okta accepts the end\
\ user's sign-in credentials as valid or not. For the Telephony inline\
\ hook, you typically only return one `commands` object with one array\
\ element in it."
items:
$ref: '#/components/schemas/TelephonyResponse_commands_inner'
type: array
type: object
TempPassword:
properties:
tempPassword:
readOnly: true
type: string
type: object
TestInfo:
description: Integration Testing Information
properties:
escalationSupportContact:
description: An email for Okta to contact your company about your integration.
This email isn't shared with customers.
example: strawberry.support@example.com
maxLength: 255
type: string
oidcTestConfiguration:
$ref: '#/components/schemas/TestInfo_oidcTestConfiguration'
samlTestConfiguration:
$ref: '#/components/schemas/TestInfo_samlTestConfiguration'
testAccount:
$ref: '#/components/schemas/TestInfo_testAccount'
required:
- escalationSupportContact
type: object
ThemeResponse:
example:
primaryColorContrastHex: primaryColorContrastHex
favicon: favicon
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
backgroundImage: backgroundImage
secondaryColorHex: secondaryColorHex
secondaryColorContrastHex: secondaryColorContrastHex
primaryColorHex: primaryColorHex
errorPageTouchPointVariant: OKTA_DEFAULT
emailTemplateTouchPointVariant: OKTA_DEFAULT
signInPageTouchPointVariant: BACKGROUND_IMAGE
loadingPageTouchPointVariant: OKTA_DEFAULT
logo: logo
id: id
endUserDashboardTouchPointVariant: OKTA_DEFAULT
properties:
backgroundImage:
readOnly: true
type: string
emailTemplateTouchPointVariant:
$ref: '#/components/schemas/EmailTemplateTouchPointVariant'
endUserDashboardTouchPointVariant:
$ref: '#/components/schemas/EndUserDashboardTouchPointVariant'
errorPageTouchPointVariant:
$ref: '#/components/schemas/ErrorPageTouchPointVariant'
favicon:
readOnly: true
type: string
id:
readOnly: true
type: string
loadingPageTouchPointVariant:
$ref: '#/components/schemas/LoadingPageTouchPointVariant'
logo:
readOnly: true
type: string
primaryColorContrastHex:
description: Primary color contrast hex code
type: string
primaryColorHex:
description: Primary color hex code
type: string
secondaryColorContrastHex:
description: Secondary color contrast hex code
type: string
secondaryColorHex:
description: Secondary color hex code
type: string
signInPageTouchPointVariant:
$ref: '#/components/schemas/SignInPageTouchPointVariant'
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
ThirdPartyAdminSetting:
description: The third-party admin setting
example:
thirdPartyAdmin: false
properties:
thirdPartyAdmin:
description: Indicates if third-party admin is enabled
example: false
type: boolean
type: object
ThreatInsightConfiguration:
example:
lastUpdated: 2020-09-08T20:53:20.882Z
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2020-08-05T22:18:30.629Z
excludeZones: []
action: none
properties:
action:
description: Specifies how Okta responds to authentication requests from
suspicious IP addresses
enum:
- none
- audit
- block
example: none
type: string
x-enumDescriptions:
none: Indicates that ThreatInsight is disabled
audit: Indicates that Okta logs suspicious requests to the System Log
block: Indicates that Okta logs suspicious requests to the System Log
and blocks the requests
created:
description: Timestamp when the ThreatInsight Configuration object was created
example: 2020-08-05T22:18:30.629Z
format: date-time
readOnly: true
type: string
excludeZones:
description: |-
Accepts a list of [Network Zone](/openapi/okta-management/management/tag/NetworkZone/) IDs.
IPs in the excluded network zones aren't logged or blocked.
This ensures that traffic from known, trusted IPs isn't accidentally logged or blocked.
example: []
items:
type: string
type: array
lastUpdated:
description: Timestamp when the ThreatInsight Configuration object was last
updated
example: 2020-09-08T20:53:20.882Z
format: date-time
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
required:
- action
type: object
TimeDuration:
description: "A time duration specified as an [ISO-8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations)."
pattern: ^P(?:$)(\d+Y)?(\d+M)?(\d+W)?(\d+D)?(T(?:\d)(\d+H)?(\d+M)?(\d+S)?)?$
type: string
TokenAuthorizationServerPolicyRuleAction:
example:
refreshTokenWindowMinutes: 1
accessTokenLifetimeMinutes: 0
inlineHook:
id: id
refreshTokenLifetimeMinutes: 6
properties:
accessTokenLifetimeMinutes:
description: Lifetime of the access token in minutes. The minimum is five
minutes. The maximum is one day.
type: integer
inlineHook:
$ref: '#/components/schemas/TokenAuthorizationServerPolicyRuleActionInlineHook'
refreshTokenLifetimeMinutes:
description: Lifetime of the refresh token is the minimum access token lifetime.
type: integer
refreshTokenWindowMinutes:
description: "Timeframe when the refresh token is valid. The minimum is\
\ 10 minutes. The maximum is five years (2,628,000 minutes)."
type: integer
type: object
TokenAuthorizationServerPolicyRuleActionInlineHook:
example:
id: id
properties:
id:
readOnly: false
type: string
type: object
TokenDeliveryMode:
enum:
- poll
type: string
TokenHookResponse:
description: |-
For the token inline hook, the `commands` and `error` objects that you can return in the JSON payload of your response are defined in the following sections.
> **Note:** The size of your response payload must be less than 256 KB.
properties:
commands:
description: |-
You can use the `commands` object to provide commands to Okta. It's where you can tell Okta to add more claims to the token.
The `commands` object is an array, allowing you to send multiple commands. In each array element, there needs to be a `type` property and `value` property. The `type` property is where you specify which of the supported commands you want to execute, and `value` is where you supply an operand for that command.
In the case of the token hook type, the `value` property is itself a nested object in which you specify a particular operation, a path to act on, and a value.
items:
$ref: '#/components/schemas/TokenHookResponse_commands_inner'
type: array
error:
$ref: '#/components/schemas/TokenHookResponse_error'
type: object
TokenPayLoad:
properties:
data:
$ref: '#/components/schemas/TokenPayLoad_data'
type: object
TokenProtocolRequest:
description: Details of the token request
properties:
client_id:
description: The ID of the client associated with the token
type: string
grant_type:
$ref: '#/components/schemas/GrantType'
redirect_uri:
description: Specifies the callback location where the authorization was
sent
format: uri
type: string
response_mode:
description: The authorization response mode
enum:
- form_post
- fragment
- okta_post_message
- query
type: string
response_type:
description: The authorization response type
enum:
- code
- id_token
- token
- none
type: string
scope:
description: The scopes requested
type: string
state:
type: string
type: object
TokenRequest:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/TokenPayLoad'
TokenResourcesHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens"
type: string
type: object
TokenResponse:
properties:
access_token:
description: An access token.
type: string
device_secret:
description: An opaque device secret. This is returned if the `device_sso`
scope is granted.
type: string
expires_in:
description: The expiration time of the access token in seconds.
type: integer
id_token:
description: An ID token. This is returned if the `openid` scope is granted.
type: string
issued_token_type:
$ref: '#/components/schemas/TokenType'
refresh_token:
description: An opaque refresh token. This is returned if the `offline_access`
scope is granted.
type: string
scope:
description: The scopes contained in the access token.
type: string
token_type:
$ref: '#/components/schemas/TokenResponseTokenType'
type: object
TokenResponseTokenType:
description: The token type in a `/token` response. The value is generally `Bearer`
except for a few instances of token exchange.
enum:
- Bearer
- N_A
type: string
TokenType:
description: The type of token for token exchange.
enum:
- urn:ietf:params:oauth:token-type:access_token
- urn:ietf:params:oauth:token-type:id_token
- urn:ietf:params:oauth:token-type:jwt
- urn:ietf:params:oauth:token-type:refresh_token
- urn:ietf:params:oauth:token-type:saml1
- urn:ietf:params:oauth:token-type:saml2
- urn:okta:oauth:token-type:web_sso_token
- urn:x-oath:params:oauth:token-type:device-secret
type: string
TrendMicroApexOneServiceApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- trendmicroapexoneservice
example: trendmicroapexoneservice
type: string
signOnMode:
enum:
- SAML_2_0
type: string
settings:
$ref: '#/components/schemas/TrendMicroApexOneServiceApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for Trend Micro Apex One as a Service app (key name: `trendmicroapexoneservice`)
To create a Trend Micro Apex One as a Service app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Trend Micro Apex One as a Service app only supports `SAML_2_0` sign-on mode.
example:
name: trendmicroapexoneservice
label: Sample Trend Micro Apex One as a Service App
signOnMode: SAML_2_0
settings:
app:
baseURL: https://acme.trendmicro.com
title: Trend Micro Apex One Service
x-tags:
- Application
x-okta-defined-as:
name: trendmicroapexoneservice
TrendMicroApexOneServiceApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/TrendMicroApexOneServiceApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
TrendMicroApexOneServiceApplicationSettingsApplication:
description: Trend Micro Apex One as a Service app instance properties
properties:
baseURL:
description: Base Trend Micro Apex One Service URL
type: string
required:
- baseURL
type: object
TrustedOrigin:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
createdBy: createdBy
_links:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
origin: origin
name: name
id: id
scopes:
- allowedOktaApps:
- OKTA_ENDUSER
- OKTA_ENDUSER
type: CORS
- allowedOktaApps:
- OKTA_ENDUSER
- OKTA_ENDUSER
type: CORS
status: ACTIVE
properties:
created:
description: Timestamp when the Trusted Origin was created
format: date-time
readOnly: true
type: string
createdBy:
description: The ID of the user who created the Trusted Origin
type: string
id:
description: Unique identifier for the Trusted Origin
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Trusted Origin was last updated
format: date-time
readOnly: true
type: string
lastUpdatedBy:
description: The ID of the user who last updated the Trusted Origin
type: string
name:
description: Unique name for the Trusted Origin
maximum: 255
type: string
origin:
description: "Unique origin URL for the Trusted Origin. The supported schemes\
\ for this attribute are HTTP, HTTPS, FTP, Ionic 2, and Capacitor."
maximum: 255
type: string
scopes:
description: Array of Scope types that this Trusted Origin is used for
items:
$ref: '#/components/schemas/TrustedOriginScope'
maximum: 3
type: array
status:
$ref: '#/components/schemas/LifecycleStatus'
_links:
$ref: '#/components/schemas/LinksSelfAndLifecycle'
type: object
TrustedOriginName:
description: Unique name for the Trusted Origin
maximum: 255
type: string
TrustedOriginOrigin:
description: "Unique origin URL for the Trusted Origin. The supported schemes\
\ for this attribute are HTTP, HTTPS, FTP, Ionic 2, and Capacitor."
maximum: 255
type: string
TrustedOriginScope:
example:
allowedOktaApps:
- OKTA_ENDUSER
- OKTA_ENDUSER
type: CORS
properties:
allowedOktaApps:
description: The allowed Okta apps for the Trusted Origin scope
items:
$ref: '#/components/schemas/IframeEmbedScopeAllowedApps'
type: array
type:
$ref: '#/components/schemas/TrustedOriginScopeType'
type: object
TrustedOriginScopeType:
description: "The scope type. Supported values: When you use `IFRAME_EMBED`\
\ as the scope type, leave the allowedOktaApps property \nempty to allow iFrame\
\ embedding of only Okta sign-in pages. Include `OKTA_ENDUSER` as a value\
\ for the allowedOktaApps \nproperty to allow iFrame embedding of both Okta\
\ sign-in pages and the Okta End-User Dashboard.\n"
enum:
- CORS
- IFRAME_EMBED
- REDIRECT
type: string
TrustedOriginScopes:
description: Array of Scope types that this Trusted Origin is used for
items:
$ref: '#/components/schemas/TrustedOriginScope'
maximum: 3
type: array
TrustedOriginWrite:
example:
origin: origin
name: name
scopes:
- allowedOktaApps:
- OKTA_ENDUSER
- OKTA_ENDUSER
type: CORS
- allowedOktaApps:
- OKTA_ENDUSER
- OKTA_ENDUSER
type: CORS
properties:
name:
description: Unique name for the Trusted Origin
maximum: 255
type: string
origin:
description: "Unique origin URL for the Trusted Origin. The supported schemes\
\ for this attribute are HTTP, HTTPS, FTP, Ionic 2, and Capacitor."
maximum: 255
type: string
scopes:
description: Array of Scope types that this Trusted Origin is used for
items:
$ref: '#/components/schemas/TrustedOriginScope'
maximum: 3
type: array
type: object
UIElement:
description: Specifies the configuration of an input field on an enrollment
form
example:
scope: scope
options:
format: text
label: label
type: type
properties:
label:
description: Label name for the UI element
type: string
options:
$ref: '#/components/schemas/UIElement_options'
scope:
description: Specifies the property bound to the input field. It must follow
the format `#/properties/PROPERTY_NAME` where `PROPERTY_NAME` is a variable
name for an attribute in `profile editor`.
type: string
type:
description: Specifies the relationship between this input element and `scope`.
The `Control` value specifies that this input controls the value represented
by `scope`.
type: string
type: object
UISchemaObject:
description: Properties of the UI schema
example:
elements:
scope: scope
options:
format: text
label: label
type: type
label: Sign in
type: type
buttonLabel: Submit
properties:
buttonLabel:
default: Submit
description: Specifies the button label for the `Submit` button at the bottom
of the enrollment form
type: string
elements:
$ref: '#/components/schemas/UIElement'
label:
default: Sign in
description: Specifies the label at the top of the enrollment form under
the logo
type: string
type:
description: Specifies the type of layout
type: string
type: object
UISchemasResponseObject:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
uiSchema:
elements:
scope: scope
options:
format: text
label: label
type: type
label: Sign in
type: type
buttonLabel: Submit
id: id
properties:
created:
description: Timestamp when the UI Schema was created (ISO-86001)
format: date-time
readOnly: true
type: string
id:
description: Unique identifier for the UI Schema
readOnly: true
type: string
lastUpdated:
description: Timestamp when the UI Schema was last modified (ISO-86001)
format: date-time
readOnly: true
type: string
uiSchema:
$ref: '#/components/schemas/UISchemaObject'
_links:
$ref: '#/components/schemas/LinksSelf'
required:
- _links
- created
- id
- lastUpdated
- uiSchema
type: object
UpdateDomain:
example:
brandId: bndul904tTZ6kWVhP0g3
properties:
brandId:
description: The `id` of the brand used to replace the existing brand.
example: bndul904tTZ6kWVhP0g3
type: string
required:
- brandId
type: object
UpdateEmailDomain:
allOf:
- $ref: '#/components/schemas/BaseEmailDomain'
example:
displayName: displayName
userName: userName
UpdateIamRoleRequest:
example:
description: description
label: label
properties:
description:
description: Description of the role
type: string
label:
description: Unique label for the role
type: string
required:
- description
- label
type: object
UpdateRealmAssignmentRequest:
example:
name: name
conditions:
expression:
value: value
profileSourceId: profileSourceId
priority: 0
actions:
assignUserToRealm:
realmId: realmId
properties:
actions:
$ref: '#/components/schemas/Actions'
conditions:
$ref: '#/components/schemas/Conditions'
name:
type: string
priority:
type: integer
type: object
UpdateRealmRequest:
example:
profile:
realmType: PARTNER
name: name
properties:
profile:
$ref: '#/components/schemas/RealmProfile'
type: object
UpdateThemeRequest:
example:
emailTemplateTouchPointVariant: OKTA_DEFAULT
signInPageTouchPointVariant: BACKGROUND_IMAGE
primaryColorContrastHex: primaryColorContrastHex
loadingPageTouchPointVariant: OKTA_DEFAULT
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
secondaryColorHex: secondaryColorHex
secondaryColorContrastHex: secondaryColorContrastHex
primaryColorHex: primaryColorHex
errorPageTouchPointVariant: OKTA_DEFAULT
endUserDashboardTouchPointVariant: OKTA_DEFAULT
properties:
emailTemplateTouchPointVariant:
$ref: '#/components/schemas/EmailTemplateTouchPointVariant'
endUserDashboardTouchPointVariant:
$ref: '#/components/schemas/EndUserDashboardTouchPointVariant'
errorPageTouchPointVariant:
$ref: '#/components/schemas/ErrorPageTouchPointVariant'
loadingPageTouchPointVariant:
$ref: '#/components/schemas/LoadingPageTouchPointVariant'
primaryColorContrastHex:
description: Primary color contrast hex code
type: string
primaryColorHex:
description: Primary color hex code
type: string
secondaryColorContrastHex:
description: Secondary color contrast hex code
type: string
secondaryColorHex:
description: Secondary color hex code
type: string
signInPageTouchPointVariant:
$ref: '#/components/schemas/SignInPageTouchPointVariant'
_links:
$ref: '#/components/schemas/LinksSelf'
required:
- emailTemplateTouchPointVariant
- endUserDashboardTouchPointVariant
- errorPageTouchPointVariant
- primaryColorHex
- secondaryColorHex
- signInPageTouchPointVariant
type: object
UpdateUISchema:
description: The updated request body properties
example:
uiSchema:
elements:
scope: scope
options:
format: text
label: label
type: type
label: Sign in
type: type
buttonLabel: Submit
properties:
uiSchema:
$ref: '#/components/schemas/UISchemaObject'
type: object
UpdateUserRequest:
example:
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
properties:
credentials:
$ref: '#/components/schemas/UserCredentials'
profile:
$ref: '#/components/schemas/UserProfile'
realmId:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>The
ID of the Realm in which the User is residing
example: guo1bfiNtSnZYILxO0g4
type: string
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
type: object
User:
example:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
properties:
activated:
description: The timestamp when the User status transitioned to `ACTIVE`
format: date-time
nullable: true
readOnly: true
type: string
created:
description: The timestamp when the User was created
format: date-time
readOnly: true
type: string
credentials:
$ref: '#/components/schemas/UserCredentials'
id:
description: The unique key for the user
readOnly: true
type: string
lastLogin:
description: The timestamp of the last login
format: date-time
nullable: true
readOnly: true
type: string
lastUpdated:
description: The timestamp when the User was last updated
format: date-time
readOnly: true
type: string
passwordChanged:
description: The timestamp when the User's password was last updated
format: date-time
nullable: true
readOnly: true
type: string
profile:
$ref: '#/components/schemas/UserProfile'
realmId:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>The
ID of the Realm in which the User is residing
example: guo1bfiNtSnZYILxO0g4
readOnly: true
type: string
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
status:
$ref: '#/components/schemas/UserStatus'
statusChanged:
description: The timestamp when the status of the User last changed
format: date-time
nullable: true
readOnly: true
type: string
transitioningToStatus:
$ref: '#/components/schemas/UserStatus'
type:
$ref: '#/components/schemas/UserType'
_embedded:
additionalProperties:
properties: {}
type: object
description: "Embedded resources related to the User using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
readOnly: true
type: object
_links:
$ref: '#/components/schemas/User__links'
type: object
UserActivationToken:
example:
activationUrl: "https://{yourOktaDomain}/welcome/XE6wE17zmphl3KqAPFxO"
activationToken: XE6wE17zmphl3KqAPFxO
properties:
activationToken:
description: |-
Token received as part of an activation user request. If a password was set before the user was activated, then user must sign in with their password or the `activationToken` and not the activation link. More information about using the `activationToken`
to login can be found in the [Authentication API](https://developer.okta.com/docs/reference/api/authn/#primary-authentication-with-activation-token).
example: XE6wE17zmphl3KqAPFxO
readOnly: true
type: string
activationUrl:
description: "If `sendEmail` is `false`, returns an activation link for\
\ the user to set up their account. The activation token can be used to\
\ create a custom activation link."
example: "https://{yourOktaDomain}/welcome/XE6wE17zmphl3KqAPFxO"
readOnly: true
type: string
type: object
UserBlock:
description: "Describes how the account is blocked from access. If `appliesTo`\
\ is `ANY_DEVICES`, then the account is blocked for all devices. If `appliesTo`\
\ is `UNKNOWN_DEVICES`, then the account is only blocked for unknown devices."
example:
appliesTo: ANY_DEVICES
type: DEVICE_BASED
properties:
appliesTo:
description: The devices that the block applies to
enum:
- ANY_DEVICES
- UNKNOWN_DEVICES
readOnly: true
type: string
x-enumDescriptions:
ANY_DEVICES: The account is blocked for all devices
UNKNOWN_DEVICES: The account is only blocked for unknown devices
type:
description: Type of access block
enum:
- DEVICE_BASED
readOnly: true
type: string
type: object
UserCondition:
description: Specifies a set of Users to be included or excluded
properties:
exclude:
description: Users to be excluded
items:
type: string
type: array
include:
description: Users to be included
items:
type: string
type: array
required:
- exclude
- include
type: object
UserCredentials:
description: Specifies primary authentication and recovery credentials for a
User. Credential types and requirements vary depending on the provider and
security policy of the org.
example:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
properties:
password:
$ref: '#/components/schemas/PasswordCredential'
provider:
$ref: '#/components/schemas/AuthenticationProvider'
recovery_question:
$ref: '#/components/schemas/RecoveryQuestionCredential'
type: object
UserFactor:
discriminator:
mapping:
call: '#/components/schemas/UserFactorCall'
email: '#/components/schemas/UserFactorEmail'
push: '#/components/schemas/UserFactorPush'
question: '#/components/schemas/UserFactorSecurityQuestion'
sms: '#/components/schemas/UserFactorSMS'
token: '#/components/schemas/UserFactorToken'
token:hardware: '#/components/schemas/UserFactorTokenHardware'
token:hotp: '#/components/schemas/UserFactorTokenHOTP'
token:software:totp: '#/components/schemas/UserFactorTokenSoftwareTOTP'
u2f: '#/components/schemas/UserFactorU2F'
web: '#/components/schemas/UserFactorWeb'
webauthn: '#/components/schemas/UserFactorWebAuthn'
hotp: '#/components/schemas/UserFactorTokenHOTP'
propertyName: factorType
example:
lastUpdated: 2022-08-25T00:31:00Z
provider: CUSTOM
_embedded:
key: "{}"
_links:
cancel:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
question:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
qrcode:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
poll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
enroll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factor:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
send:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2022-08-25T00:31:00Z
profile: "{}"
factorType: call
id: caf8m6jbcvUH8mAep1d7
vendorName: OKTA
status: ACTIVE
properties:
created:
description: Timestamp when the Factor was enrolled
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
factorType:
$ref: '#/components/schemas/UserFactorType'
id:
description: ID of the Factor
example: caf8m6jbcvUH8mAep1d7
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Factor was last updated
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
profile:
description: Specific attributes related to the Factor
type: object
provider:
$ref: '#/components/schemas/UserFactorProvider'
status:
$ref: '#/components/schemas/UserFactorStatus'
vendorName:
description: Name of the Factor vendor. This is usually the same as the
provider except for On-Prem MFA where it depends on administrator settings.
example: OKTA
readOnly: true
type: string
_embedded:
additionalProperties:
properties: {}
type: object
readOnly: true
type: object
_links:
$ref: '#/components/schemas/UserFactorLinks'
type: object
UserFactorActivatePush:
description: "Activation requests have a short lifetime and expire if the activation\
\ isn't completed before the indicated timestamp. If the activation expires,\
\ use the returned `activate` link to restart the process."
properties:
expiresAt:
description: Timestamp when the Factor verification attempt expires
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
factorResult:
$ref: '#/components/schemas/UserFactorActivatePushResult'
type: object
UserFactorActivatePushResult:
description: Result of a Factor activation
enum:
- CANCELLED
- ERROR
- TIMEOUT
- WAITING
type: string
UserFactorActivateRequest:
example:
attestation: o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEgwRgIhAMvf2+dzXlHZN1um38Y8aFzrKvX0k5dt/hnDu9lahbR4AiEAuwtMg3IoaElWMp00QrP/+3Po/6LwXfmYQVfsnsQ+da1oYXV0aERhdGFYxkgb9OHGifjS2dG03qLRqvXrDIRyfGAuc+GzF1z20/eVRV2wvl6tzgACNbzGCmSLCyXx8FUDAEIBvWNHOcE3QDUkDP/HB1kRbrIOoZ1dR874ZaGbMuvaSVHVWN2kfNiO4D+HlAzUEFaqlNi5FPqKw+mF8f0XwdpEBlClAQIDJiABIVgg0a6oo3W0JdYPu6+eBrbr0WyB3uJLI3ODVgDfQnpgafgiWCB4fFo/5iiVrFhB8pNH2tbBtKewyAHuDkRolcCnVaCcmQ==
clientData: eyJjaGFsbGVuZ2UiOiJVSk5wYW9sVWt0dF9vcEZPNXJMYyIsIm9yaWdpbiI6Imh0dHBzOi8vcmFpbi5va3RhMS5jb20iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0
passCode: "1234567890"
registrationData: registrationData
properties:
passCode:
description: OTP for the current time window
example: "1234567890"
type: string
registrationData:
type: string
attestation:
description: Base64-encoded attestation from the WebAuthn authenticator
example: o2NmbXRmcGFja2VkZ2F0dFN0bXSiY2FsZyZjc2lnWEgwRgIhAMvf2+dzXlHZN1um38Y8aFzrKvX0k5dt/hnDu9lahbR4AiEAuwtMg3IoaElWMp00QrP/+3Po/6LwXfmYQVfsnsQ+da1oYXV0aERhdGFYxkgb9OHGifjS2dG03qLRqvXrDIRyfGAuc+GzF1z20/eVRV2wvl6tzgACNbzGCmSLCyXx8FUDAEIBvWNHOcE3QDUkDP/HB1kRbrIOoZ1dR874ZaGbMuvaSVHVWN2kfNiO4D+HlAzUEFaqlNi5FPqKw+mF8f0XwdpEBlClAQIDJiABIVgg0a6oo3W0JdYPu6+eBrbr0WyB3uJLI3ODVgDfQnpgafgiWCB4fFo/5iiVrFhB8pNH2tbBtKewyAHuDkRolcCnVaCcmQ==
type: string
clientData:
description: Base64-encoded client data from the WebAuthn authenticator
example: eyJjaGFsbGVuZ2UiOiJVSk5wYW9sVWt0dF9vcEZPNXJMYyIsIm9yaWdpbiI6Imh0dHBzOi8vcmFpbi5va3RhMS5jb20iLCJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIn0
type: string
type: object
UserFactorActivateResponse:
discriminator:
mapping:
call: '#/components/schemas/UserFactorCall'
email: '#/components/schemas/UserFactorEmail'
sms: '#/components/schemas/UserFactorSMS'
push: '#/components/schemas/UserFactorPush'
token:software:totp: '#/components/schemas/UserFactorTokenSoftwareTOTP'
u2f: '#/components/schemas/UserFactorU2F'
webauthn: '#/components/schemas/UserFactorWebAuthn'
propertyName: factorType
example:
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factorType: call
properties:
factorType:
description: Type of the Factor
enum:
- call
- email
- sms
- push
- token:software:totp
- u2f
- webauthn
type: string
_links:
$ref: '#/components/schemas/UserFactorActivateResponse__links'
type: object
UserFactorCall:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorCallProfile'
type: object
title: call
UserFactorCallProfile:
properties:
phoneExtension:
description: Extension of the associated `phoneNumber`
example: "1234"
maxLength: 15
nullable: true
type: string
phoneNumber:
description: "Phone number of the Factor. Format phone numbers to use the\
\ [E.164 standard](https://www.itu.int/rec/T-REC-E.164/)."
example: "+15554151337"
maxLength: 15
pattern: "^\\+[1-9]\\d{1,14}$"
type: string
type: object
UserFactorEmail:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorEmailProfile'
type: object
title: email
UserFactorEmailProfile:
properties:
email:
description: Email address of the user. This must be either the primary
or secondary email address associated with the Okta user account.
example: z.cool@example.com
maxLength: 100
type: string
type: object
UserFactorLinks:
allOf:
- $ref: '#/components/schemas/LinksActivate'
- $ref: '#/components/schemas/LinksCancel'
- $ref: '#/components/schemas/LinksDeactivate'
- $ref: '#/components/schemas/LinksEnroll'
- $ref: '#/components/schemas/LinksFactor'
- $ref: '#/components/schemas/LinksPoll'
- $ref: '#/components/schemas/LinksQrcode'
- $ref: '#/components/schemas/LinksQuestions'
- $ref: '#/components/schemas/LinksResend'
- $ref: '#/components/schemas/LinksSend'
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksUser'
- $ref: '#/components/schemas/LinksVerify'
example:
cancel:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
question:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
qrcode:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
poll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
enroll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factor:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
send:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
readOnly: true
UserFactorPassCode:
description: OTP for the current time window
example: "1234567890"
type: string
UserFactorProvider:
description: Provider for the Factor
enum:
- CUSTOM
- DUO
- FIDO
- GOOGLE
- OKTA
- RSA
- SYMANTEC
- YUBICO
type: string
UserFactorPush:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorPushProfile'
type: object
title: push
UserFactorPushProfile:
properties:
credentialId:
description: ID for the Factor credential
example: dade.murphy@example.com
type: string
deviceToken:
description: Token used to identify the device
example: fwf7ku6bsiSCieh6y1d7
type: string
deviceType:
description: Type of device
example: SmartPhone_IPhone
type: string
name:
description: Name of the device
example: My Phone
type: string
platform:
description: OS version of the associated device
example: IOS
type: string
version:
description: Installed version of Okta Verify
example: "9.0"
type: string
type: object
UserFactorPushTransaction:
discriminator:
mapping:
WAITING: '#/components/schemas/UserFactorPushTransactionWaiting'
SUCCESS: '#/components/schemas/UserFactorPushTransaction'
REJECTED: '#/components/schemas/UserFactorPushTransactionRejected'
TIMEOUT: '#/components/schemas/UserFactorPushTransactionTimeout'
propertyName: factorResult
example:
factorResult: WAITING
properties:
factorResult:
description: Result of the verification transaction
enum:
- WAITING
- SUCCESS
- REJECTED
- TIMEOUT
type: string
type: object
UserFactorPushTransactionRejected:
allOf:
- $ref: '#/components/schemas/UserFactorPushTransaction'
- properties:
profile:
$ref: '#/components/schemas/UserFactorPushTransactionRejected_allOf_profile'
_links:
$ref: '#/components/schemas/UserFactorPushTransactionRejected_allOf__links'
type: object
UserFactorPushTransactionSuccess:
$ref: '#/components/schemas/UserFactorPushTransaction'
UserFactorPushTransactionTimeout:
allOf:
- $ref: '#/components/schemas/UserFactorPushTransaction'
- properties:
profile:
$ref: '#/components/schemas/UserFactorPushTransactionRejected_allOf_profile'
_links:
$ref: '#/components/schemas/UserFactorPushTransactionTimeout_allOf__links'
type: object
UserFactorPushTransactionWaiting:
allOf:
- $ref: '#/components/schemas/UserFactorPushTransaction'
- properties:
profile:
$ref: '#/components/schemas/UserFactorPushTransactionRejected_allOf_profile'
_links:
$ref: '#/components/schemas/UserFactorPushTransactionWaiting_allOf__links'
type: object
UserFactorResultType:
description: Result of a Factor verification attempt
enum:
- CANCELLED
- CHALLENGE
- ERROR
- FAILED
- PASSCODE_REPLAYED
- REJECTED
- SUCCESS
- TIMEOUT
- TIME_WINDOW_EXCEEDED
- WAITING
readOnly: true
type: string
UserFactorSMS:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorSMSProfile'
type: object
title: sms
UserFactorSMSProfile:
properties:
phoneNumber:
description: "Phone number of the Factor. You should format phone numbers\
\ to use the [E.164 standard](https://www.itu.int/rec/T-REC-E.164/)."
example: "+15554151337"
maxLength: 15
pattern: "^\\+[1-9]\\d{1,14}$"
type: string
type: object
UserFactorSecurityQuestion:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorSecurityQuestionProfile'
type: object
title: question
UserFactorSecurityQuestionProfile:
example:
answer: answer
question: disliked_food
questionText: What is the food you least liked as a child?
properties:
answer:
description: Answer to the question
minLength: 4
type: string
writeOnly: true
question:
description: Unique key for the question
enum:
- disliked_food
- name_of_first_plush_toy
- first_award
- favorite_security_question
- favorite_toy
- first_computer_game
- favorite_movie_quote
- first_sports_team_mascot
- first_music_purchase
- favorite_art_piece
- grandmother_favorite_desert
- first_thing_cooked
- childhood_dream_job
- first_kiss_location
- place_where_significant_other_was_met
- favorite_vacation_location
- new_years_two_thousand
- favorite_speaker_actor
- favorite_book_movie_character
- favorite_sports_player
example: disliked_food
type: string
questionText:
description: Human-readable text that's displayed to the user
example: What is the food you least liked as a child?
readOnly: true
type: string
type: object
UserFactorSignatureData:
description: Base64-encoded signature data from the WebAuthn authenticator
type: string
UserFactorStatus:
description: Status of the Factor
enum:
- ACTIVE
- DISABLED
- ENROLLED
- EXPIRED
- INACTIVE
- NOT_SETUP
- PENDING_ACTIVATION
example: ACTIVE
readOnly: true
type: string
UserFactorSupported:
example:
provider: CUSTOM
_embedded:
key: "{}"
_links:
cancel:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
question:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
qrcode:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
poll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
enroll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factor:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
send:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factorType: call
vendorName: OKTA
enrollment: OPTIONAL
status: ACTIVE
properties:
enrollment:
description: Indicates if the Factor is required for the specified user
enum:
- OPTIONAL
- REQUIRED
example: OPTIONAL
type: string
factorType:
$ref: '#/components/schemas/UserFactorType'
provider:
$ref: '#/components/schemas/UserFactorProvider'
status:
$ref: '#/components/schemas/UserFactorStatus'
vendorName:
description: Name of the Factor vendor. This is usually the same as the
provider except for On-Prem MFA where it depends on administrator settings.
example: OKTA
readOnly: true
type: string
_embedded:
additionalProperties:
properties: {}
type: object
description: Embedded resources related to the Factor
readOnly: true
type: object
_links:
$ref: '#/components/schemas/UserFactorLinks'
type: object
UserFactorToken:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorTokenProfile'
verify:
$ref: '#/components/schemas/UserFactorToken_allOf_verify'
type: object
title: token
UserFactorTokenFactorVerificationObject:
properties:
nextPassCode:
description: OTP for the next time window
example: "678195"
type: string
passCode:
description: OTP for the current time window
example: "875498"
type: string
type: object
UserFactorTokenHOTP:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
factorProfileId:
description: "ID of an existing Custom TOTP Factor profile. To create\
\ this, see [Custom TOTP Factor](https://help.okta.com/okta_help.htm?id=ext-mfa-totp)."
type: string
profile:
$ref: '#/components/schemas/UserFactorTokenHOTPProfile'
type: object
title: token:hotp
UserFactorTokenHOTPProfile:
properties:
sharedSecret:
description: Unique secret key used to generate the OTP
example: 484f97be3213b117e3a20438e291540a
type: string
type: object
UserFactorTokenHardware:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorTokenProfile'
verify:
$ref: '#/components/schemas/UserFactorTokenHardware_allOf_verify'
type: object
title: token:hardware
UserFactorTokenProfile:
properties:
credentialId:
description: ID for the Factor credential
example: dade.murphy@example.com
type: string
type: object
UserFactorTokenSoftwareTOTP:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorTokenProfile'
type: object
title: token:software:totp
UserFactorTokenVerifyRSA:
properties:
passCode:
description: OTP for the current time window
example: "5275875498"
type: string
title: RSA SecurID
type: object
UserFactorTokenVerifySymantec:
properties:
nextPassCode:
description: OTP for the next time window
example: 3956685498
type: integer
passCode:
description: OTP for the current time window
example: "5275875498"
type: string
title: Symantec VIP
type: object
UserFactorType:
description: Type of Factor
enum:
- call
- email
- push
- question
- signed_nonce
- sms
- token
- token:hardware
- token:hotp
- token:software:totp
- u2f
- web
- webauthn
type: string
UserFactorU2F:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorU2FProfile'
type: object
title: u2f
UserFactorU2FProfile:
properties:
credentialId:
description: ID for the Factor credential
example: dade.murphy@example.com
type: string
type: object
UserFactorVerifyRequest:
example:
signatureData: signatureData
answer: answer
nextPassCode: nextPassCode
clientData: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ
passCode: "1234567890"
authenticatorData: authenticatorData
properties:
passCode:
description: OTP for the current time window
example: "1234567890"
type: string
answer:
description: Answer to the question
minLength: 4
type: string
writeOnly: true
clientData:
description: Base64-encoded client data from the U2F token
example: eyJ0eXAiOiJuYXZpZ2F0b3IuaWQuZmluaXNoRW5yb2xsbWVudCIsImNoYWxsZW5nZSI6IlhxR0h0RTBoUkxuVEoxYUF5U1oyIiwib3JpZ2luIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6MzAwMCIsImNpZF9wdWJrZXkiOiJ1bnVzZWQifQ
type: string
signatureData:
description: Base64-encoded signature data from the U2F token
type: string
authenticatorData:
description: Base64-encoded authenticator data from the WebAuthn authenticator
type: string
nextPassCode:
type: string
type: object
UserFactorVerifyResponse:
example:
_embedded:
key: "{}"
_links:
cancel:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
question:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
qrcode:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
poll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
enroll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factor:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
send:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factorResult: CHALLENGE
factorMessage: factorMessage
expiresAt: 2022-08-25T00:31:00Z
properties:
expiresAt:
description: Timestamp when the verification expires
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
factorMessage:
description: Optional display message for Factor verification
nullable: true
readOnly: true
type: string
factorResult:
$ref: '#/components/schemas/UserFactorVerifyResult'
_embedded:
additionalProperties:
properties: {}
type: object
readOnly: true
type: object
_links:
$ref: '#/components/schemas/UserFactorLinks'
type: object
UserFactorVerifyResult:
description: Result of a Factor verification
enum:
- CHALLENGE
- ERROR
- EXPIRED
- FAILED
- PASSCODE_REPLAYED
- REJECTED
- SUCCESS
- TIMEOUT
- TIME_WINDOW_EXCEEDED
- WAITING
type: string
x-enumDescriptions:
CANCELED: User cancelled the verification
CHALLENGE: Okta issued a verification challenge
ERROR: Verification encountered an unexpected server error
EXPIRED: User didn't complete the verification within the allowed time window
FAILED: Verification failed
PASSCODE_REPLAYED: User previously verified the Factor within the same time
window. Another verification is required during another time window.
REJECTED: User rejected the verification
SUCCESS: User completed the verification
TIMEOUT: Okta didn't complete the verification within the allowed time window
TIME_WINDOW_EXCEEDED: User completed the verification outside of the allowed
time window. Another verification is required.
WAITING: Verification is in progress
UserFactorWeb:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorWebProfile'
type: object
title: web
UserFactorWebAuthn:
allOf:
- $ref: '#/components/schemas/UserFactor'
- properties:
profile:
$ref: '#/components/schemas/UserFactorWebAuthnProfile'
type: object
title: webauthn
UserFactorWebAuthnProfile:
properties:
authenticatorName:
description: Human-readable name of the authenticator
example: MacBook Touch ID
type: string
credentialId:
description: ID for the Factor credential
example: AHoOEhwvYiMv6SSwLp7KYRNttXtg_kYgQoQiEIWPFH_T3Ztp5Vj3bQ5H0LypIFR8ka8kfiCJ3I5qVpxrsd6JTMWKcE3xNh_U2QVF0Kwlan8Fiw
type: string
type: object
UserFactorWebProfile:
properties:
credentialId:
description: ID for the Factor credential
example: dade.murphy@example.com
type: string
type: object
UserFactorYubikeyOtpToken:
example:
lastUpdated: 2022-08-25T00:31:00Z
_embedded:
key: "{}"
_links:
cancel:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
question:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
qrcode:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
poll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
enroll:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
factor:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
send:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2022-08-25T00:31:00Z
profile:
key: "{}"
lastVerified: 2022-08-25T00:31:00Z
id: ykkwcx13nrDq8g4oy0g3
status: BLOCKED
properties:
created:
description: Timestamp when the Token was created
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
id:
description: ID of the Token
example: ykkwcx13nrDq8g4oy0g3
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Token was last updated
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
lastVerified:
description: Timestamp when the Token was last verified
example: 2022-08-25T00:31:00Z
format: date-time
readOnly: true
type: string
profile:
additionalProperties:
properties: {}
type: object
description: Specified profile information for token
type: object
status:
description: Token status
enum:
- BLOCKED
- UNASSIGNED
- ACTIVE
- REVOKED
- DELETED
- INACTIVE
type: string
_embedded:
additionalProperties:
properties: {}
type: object
type: object
_links:
$ref: '#/components/schemas/UserFactorLinks'
type: object
UserGetSingleton:
allOf:
- $ref: '#/components/schemas/User'
- properties:
_embedded:
$ref: '#/components/schemas/UserGetSingleton_allOf__embedded'
type: object
example:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
blocks:
- appliesTo: ANY_DEVICES
type: DEVICE_BASED
- appliesTo: ANY_DEVICES
type: DEVICE_BASED
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
UserIdentifierConditionEvaluatorPattern:
description: Used in the User Identifier Condition object. Specifies the details
of the patterns to match against.
properties:
matchType:
$ref: '#/components/schemas/UserIdentifierMatchType'
value:
description: The regular expression or simple match string
type: string
required:
- matchType
- value
type: object
UserIdentifierMatchType:
description: "The type of pattern. For regex, use `EXPRESSION`."
enum:
- CONTAINS
- EQUALS
- EXPRESSION
- STARTS_WITH
- SUFFIX
type: string
UserIdentifierPolicyRuleCondition:
description: Specifies a user identifier condition to match on
properties:
attribute:
description: The name of the profile attribute to match against. Only used
when type is `ATTRIBUTE`.
type: string
patterns:
items:
$ref: '#/components/schemas/UserIdentifierConditionEvaluatorPattern'
type: array
type:
$ref: '#/components/schemas/UserIdentifierType'
required:
- patterns
- type
type: object
UserIdentifierType:
description: "What to match against, either user ID or an attribute in the user's\
\ Okta profile."
enum:
- ATTRIBUTE
- IDENTIFIER
type: string
UserIdentityProviderLinkRequest:
example:
externalId: "121749775026145"
properties:
externalId:
description: Unique IdP-specific identifier for a User
example: "121749775026145"
type: string
type: object
UserImportRequest:
properties:
data:
$ref: '#/components/schemas/UserImportRequestData'
eventType:
description: The type of inline hook. The user import inline hook type is
`com.okta.import.transform`.
type: string
source:
description: The ID of the user import inline hook
type: string
type: object
UserImportRequestData:
properties:
action:
$ref: '#/components/schemas/UserImportRequestData_action'
appUser:
$ref: '#/components/schemas/UserImportRequestData_appUser'
context:
$ref: '#/components/schemas/UserImportRequestData_context'
user:
$ref: '#/components/schemas/UserImportRequestData_user'
type: object
UserImportResponse:
properties:
commands:
description: |-
The `commands` object is where you can provide commands to Okta. It is an array that allows you to send multiple commands.
Each array element needs to consist of a type-value pair.
items:
$ref: '#/components/schemas/UserImportResponse_commands_inner'
type: array
error:
$ref: '#/components/schemas/UserImportResponse_error'
type: object
UserLifecycleAttributePolicyRuleCondition:
properties:
attributeName:
type: string
matchingValue:
type: string
type: object
UserLockoutSettings:
example:
preventBruteForceLockoutFromUnknownDevices: false
properties:
preventBruteForceLockoutFromUnknownDevices:
default: false
description: Prevents brute-force lockout from unknown devices for the password
authenticator.
type: boolean
type: object
UserNextLogin:
enum:
- changePassword
type: string
UserPolicyRuleCondition:
description: Specifies a set of Users to be included or excluded
properties:
exclude:
description: Users to be excluded
items:
type: string
type: array
inactivity:
$ref: '#/components/schemas/InactivityPolicyRuleCondition'
include:
description: Users to be included
items:
type: string
type: array
lifecycleExpiration:
$ref: '#/components/schemas/LifecycleExpirationPolicyRuleCondition'
passwordExpiration:
$ref: '#/components/schemas/PasswordExpirationPolicyRuleCondition'
userLifecycleAttribute:
$ref: '#/components/schemas/UserLifecycleAttributePolicyRuleCondition'
type: object
UserProfile:
additionalProperties: true
description: |-
Specifies the default and custom profile properties for a user.
The default user profile is based on the [System for Cross-domain Identity Management: Core Schema](https://datatracker.ietf.org/doc/html/rfc7643).
The only permitted customizations of the default profile are to update permissions, change whether the `firstName` and `lastName` properties are nullable, and specify a [pattern](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation) for `login`. You can use the Profile Editor in the Admin Console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to make schema modifications.
You can extend user profiles with custom properties. You must first add the custom property to the user profile schema before you reference it.
You can use the Profile Editor in the Admin console or the [Schemas API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UISchema/#tag/UISchema) to manage schema extensions.
Custom attributes can contain HTML tags. It's the client's responsibility to escape or encode this data before displaying it. Use [best-practices](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html) to prevent cross-site scripting.
example:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
properties:
city:
description: The city or locality of the User's address (`locality`)
maxLength: 128
nullable: true
type: string
costCenter:
description: Name of the cost center assigned to a user
nullable: true
type: string
countryCode:
description: "The country name component of the User's address (`country`).\
\ For validation, see [ISO 3166-1 alpha 2 \"short\" code format](https://datatracker.ietf.org/doc/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
maxLength: 2
nullable: true
type: string
department:
description: Name of the User's department
type: string
displayName:
description: Name of the User suitable for display to end users
nullable: true
type: string
division:
description: Name of the User's division
nullable: true
type: string
email:
description: "The primary email address of the user. For validation, see\
\ [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
format: email
maxLength: 100
minLength: 5
type: string
employeeNumber:
description: The organization or company assigned unique identifier for
the user
type: string
firstName:
description: Given name of the User (`givenName`)
maxLength: 50
minLength: 1
nullable: true
type: string
honorificPrefix:
description: "Honorific prefix(es) of the user, or title in most Western\
\ languages"
nullable: true
type: string
honorificSuffix:
description: Honorific suffix(es) of the User
nullable: true
type: string
lastName:
description: The family name of the User (`familyName`)
maxLength: 50
minLength: 1
nullable: true
type: string
locale:
description: |-
The User's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on.
A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example, en_US specifies the language English and country US. This value is `en_US` by default.
type: string
login:
description: |-
The unique identifier for the User (`username`). For validation, see [Login pattern validation](https://developer.okta.com/docs/reference/api/schemas/#login-pattern-validation).
Every user within your Okta org must have a unique identifier for a login. This constraint applies to all users you import from other systems or applications such as Active Directory. Your organization is the top-level namespace to mix and match logins from all your connected applications or directories. Careful consideration of naming conventions for your login identifier will make it easier to onboard new applications in the future.
Logins are not considered unique if they differ only in case and/or diacritical marks. If one of your users has a login of Isaac.Brock@example.com, there cannot be another user whose login is isaac.brock@example.com, nor isáàc.bröck@example.com.
Okta has a default ambiguous name resolution policy for usernames that include @-signs. (By default, usernames must be formatted as email addresses and thus always include @-signs. You can remove that restriction using either the Admin Console or the Schemas API (opens new window).) Users can sign in with their non-qualified short name (for example: isaac.brock with username isaac.brock@example.com) as long as the short name is still unique within the organization.
maxLength: 100
minLength: 5
type: string
manager:
description: The `displayName` of the User's manager
nullable: true
type: string
managerId:
description: The `id` of the User's manager
nullable: true
type: string
middleName:
description: The middle name of the user
nullable: true
type: string
mobilePhone:
description: The mobile phone number of the user
maxLength: 100
minLength: 0
nullable: true
type: string
nickName:
description: The casual way to address the User in real life
nullable: true
type: string
organization:
description: Name of the the User's organization
nullable: true
type: string
postalAddress:
description: Mailing address component of the User's address
maxLength: 4096
nullable: true
type: string
preferredLanguage:
description: "The User's preferred written or spoken language. For validation,\
\ see [RFC 7231 Section 5.3.5](https://datatracker.ietf.org/doc/html/rfc7231#section-5.3.5)."
nullable: true
type: string
primaryPhone:
description: The primary phone number of the User such as a home number
maxLength: 100
minLength: 0
nullable: true
type: string
profileUrl:
description: "The URL of the User's online profile. For example, a web page.\
\ See [URL](https://datatracker.ietf.org/doc/html/rfc1808)."
nullable: true
type: string
secondEmail:
description: "The secondary email address of the User typically used for\
\ account recovery. For validation, see [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
format: email
maxLength: 100
minLength: 5
nullable: true
type: string
state:
description: The state or region component of the User's address (`region`)
maxLength: 128
nullable: true
type: string
streetAddress:
description: The full street address component of the User's address
maxLength: 1024
nullable: true
type: string
timezone:
description: The User's time zone
nullable: true
type: string
title:
description: "The User's title, such as Vice President"
nullable: true
type: string
userType:
description: "The property used to describe the organization-to-user relationship,\
\ such as employee or contractor"
nullable: true
type: string
zipCode:
description: The ZIP code or postal code component of the User's address
(`postalCode`)
maxLength: 50
nullable: true
type: string
type: object
UserProvisioningApplicationFeature:
allOf:
- $ref: '#/components/schemas/ApplicationFeature'
- type: object
- properties:
capabilities:
$ref: '#/components/schemas/CapabilitiesObject'
UserResourceHrefObject:
properties:
href:
description: Link URI
example: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7"
type: string
title:
description: Link name
example: SAML Jackson
type: string
type: object
UserRiskGetResponse:
discriminator:
mapping:
HIGH: '#/components/schemas/UserRiskLevelExists'
MEDIUM: '#/components/schemas/UserRiskLevelExists'
LOW: '#/components/schemas/UserRiskLevelExists'
NONE: '#/components/schemas/UserRiskLevelNone'
propertyName: riskLevel
properties:
riskLevel:
$ref: '#/components/schemas/UserRiskLevelAll'
_links:
$ref: '#/components/schemas/UserRiskGetResponse__links'
type: object
UserRiskLevelAll:
description: The risk level associated with the user
enum:
- HIGH
- LOW
- MEDIUM
- NONE
type: string
UserRiskLevelExists:
allOf:
- $ref: '#/components/schemas/UserRiskGetResponse'
- properties:
reason:
$ref: '#/components/schemas/UserRiskReason'
type: object
UserRiskLevelNone:
allOf:
- $ref: '#/components/schemas/UserRiskGetResponse'
UserRiskLevelPut:
description: The risk level associated with the user
enum:
- HIGH
- LOW
type: string
UserRiskPutResponse:
properties:
reason:
description: Describes the risk level for the user
example: Admin override risk
type: string
riskLevel:
$ref: '#/components/schemas/UserRiskLevelPut'
_links:
$ref: '#/components/schemas/UserRiskGetResponse__links'
type: object
UserRiskReason:
description: Describes the risk level for the user
example: Admin override risk
type: string
UserRiskRequest:
properties:
riskLevel:
description: The risk level associated with the user
enum:
- HIGH
- LOW
type: string
type: object
UserSchema:
example:
lastUpdated: lastUpdated
$schema: $schema
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: created
name: name
id: id
title: title
type: type
definitions: ""
properties: ""
properties:
$schema:
description: JSON Schema version identifier
readOnly: true
type: string
created:
description: Timestamp when the Schema was created
readOnly: true
type: string
definitions:
allOf:
- $ref: '#/components/schemas/UserSchemaDefinitions'
description: |-
User Profile subschemas
The Profile object for a User is defined by a composite Schema of base and custom properties using a JSON path to reference subschemas. The `#base` properties are defined and versioned by Okta, while `#custom` properties are extensible. Custom property names for the Profile object must be unique and can't conflict with a property name defined in the `#base` subschema.
id:
description: URI of User Schema
readOnly: true
type: string
lastUpdated:
description: Timestamp when the Schema was last updated
readOnly: true
type: string
name:
description: Name of the Schema
readOnly: true
type: string
properties:
allOf:
- $ref: '#/components/schemas/UserSchemaProperties'
description: User Object Properties
title:
description: User-defined display name for the Schema
type: string
type:
description: "Type of [root Schema](https://tools.ietf.org/html/draft-zyp-json-schema-04#section-3.4)"
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
UserSchemaAttribute:
properties:
description:
description: Description of the property
type: string
enum:
description: |-
Enumerated value of the property.
The value of the property is limited to one of the values specified in the enum definition. The list of values for the enum must consist of unique elements.
items:
description: TODO default missing array inner type to string
type: string
nullable: true
type: array
items:
$ref: '#/components/schemas/UserSchemaAttributeItems'
externalName:
description: |-
Name of the property as it exists in an external application
**NOTE**: When you add a custom property, only Identity Provider app user schemas require `externalName` to be
included in the request body. If an existing custom Identity Provider app user schema property has an empty
`externalName`, requests aren't allowed to update other properties until the `externalName` is defined.
type: string
externalNamespace:
description: Namespace from the external application
type: string
format:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeFormat'
description: Identifies the type of data represented by the string
master:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeMaster'
description: Identifies where the property is mastered
maxLength:
description: Maximum character length of a string property
nullable: true
type: integer
minLength:
description: Minimum character length of a string property
nullable: true
type: integer
mutability:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeMutabilityString'
description: Defines the mutability of the property
oneOf:
description: |-
Non-empty array of valid JSON schemas.
Okta only supports `oneOf` for specifying display names for an `enum`. Each schema has the following format:
```
{
"const": "enumValue",
"title": "display name"
}
```json
When `enum` is used in conjunction with `oneOf`, you must keep the set of enumerated values and their order.
```
{"enum": ["S","M","L","XL"],
"oneOf": [
{"const": "S", "title": "Small"},
{"const": "M", "title": "Medium"},
{"const": "L", "title": "Large"},
{"const": "XL", "title": "Extra Large"}
]
}
```json
The `oneOf` key is only supported in conjunction with `enum` and provides a mechanism to return a display name for the `enum` value.
items:
$ref: '#/components/schemas/UserSchemaAttributeEnum'
nullable: true
type: array
pattern:
description: "For `string` property types, specifies the regular expression\
\ used to validate the property"
type: string
permissions:
description: Access control permissions for the property
items:
$ref: '#/components/schemas/UserSchemaAttributePermission'
nullable: true
type: array
required:
description: Determines whether the property is required
nullable: true
type: boolean
scope:
$ref: '#/components/schemas/UserSchemaAttributeScope'
title:
description: User-defined display name for the property
minLength: 1
type: string
type:
allOf:
- $ref: '#/components/schemas/UserSchemaAttributeType'
description: Type of property
unique:
type: string
type: object
x-okta-allow-null-property-value-for-updates: true
UserSchemaAttributeEnum:
example:
const: const
title: title
properties:
const:
type: string
title:
type: string
type: object
UserSchemaAttributeFormat:
enum:
- country-code
- date-time
- email
- encrypted
- hashed
- language-code
- locale
- ref-id
- timezone
- uri
type: string
UserSchemaAttributeItems:
example:
oneOf:
- const: const
title: title
- const: const
title: title
type: type
enum:
- enum
- enum
properties:
enum:
items:
type: string
type: array
oneOf:
items:
$ref: '#/components/schemas/UserSchemaAttributeEnum'
type: array
type:
type: string
type: object
UserSchemaAttributeMaster:
nullable: true
properties:
priority:
items:
$ref: '#/components/schemas/UserSchemaAttributeMasterPriority'
type: array
type:
$ref: '#/components/schemas/UserSchemaAttributeMasterType'
type: object
UserSchemaAttributeMasterPriority:
properties:
type:
type: string
value:
type: string
type: object
UserSchemaAttributeMasterType:
enum:
- OKTA
- OVERRIDE
- PROFILE_MASTER
type: string
UserSchemaAttributeMutabilityString:
enum:
- IMMUTABLE
- READ_ONLY
- READ_WRITE
- WRITE_ONLY
type: string
UserSchemaAttributePermission:
example:
principal: principal
action: action
properties:
action:
description: Determines whether the principal can view or modify the property
type: string
principal:
description: Security principal
type: string
type: object
UserSchemaAttributeScope:
enum:
- NONE
- SELF
type: string
UserSchemaAttributeType:
enum:
- array
- boolean
- integer
- number
- string
type: string
UserSchemaBase:
description: |-
All Okta-defined Profile properties are defined in a Profile subschema with the resolution scope `#base`. You can't modify these properties, except to update permissions, to change the nullability of `firstName` and `lastName`, or to specify a pattern for `login`. They can't be removed.
The base User Profile is based on the [System for Cross-domain Identity Management: Core Schema](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#section-4.1.1) and has the standard properties detailed below.
properties:
id:
description: The subschema name
readOnly: true
type: string
properties:
allOf:
- $ref: '#/components/schemas/UserSchemaBaseProperties'
description: The `#base` object properties
required:
description: A collection indicating required property names
items:
type: string
readOnly: true
type: array
type:
description: The object type
readOnly: true
type: string
type: object
UserSchemaBaseProperties:
properties:
city:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: City or locality component of the User's address (`locality`)
costCenter:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Name of a cost center assigned to the User
countryCode:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "Country name component of the User's address (`country`.)\
\ This property uses [ISO 3166-1 alpha 2 \"short\" code format](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
department:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Name of the User's department
displayName:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "Name of the User, suitable for display to end Users"
division:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Name of the User's division
email:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "Primary email address of the User. This property is formatted\
\ according to [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
employeeNumber:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Organization or company assigned unique identifier for the
User
firstName:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Given name of the User (`givenName`)
honorificPrefix:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Honorific prefix(es) of the User or title in most Western languages
honorificSuffix:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Honorific suffix(es) of the User
lastName:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Family name of the User (`familyName`)
locale:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: |-
User's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on.
A locale value is a concatenation of the ISO 639-1 two-letter language code, an underscore, and the ISO 3166-1 two-letter country code. For example: `en_US` specifies the language English and country US. This value is `en_US` by default.
login:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: |-
Unique identifier for the User (`username`)
The login property is validated according to its pattern attribute, which is a string. By default, the attribute is null. When the attribute is null, the username is required to be formatted as an email address as defined by [RFC 6531 Section 3.3](http://tools.ietf.org/html/rfc6531#section-3.3). The pattern can be set through the API to one of the following forms. (The Admin Console provides access to the same forms.)
* A login pattern of `".+"` indicates that there is no restriction on usernames. Any non-empty, unique value is permitted, and the minimum length of five isn't enforced. In this case, usernames don't need to include the `@` character. If a name does include `@`, the portion ahead of the `@` can be used for logging in, provided it identifies a unique User within the org.
* A login pattern of the form `"[...]+"` indicates that usernames must only contain characters from the set given between the brackets. The enclosing brackets and final `+` are required for this form. Character ranges can be indicated using hyphens. To include the hyphen itself in the allowed set, the hyphen must appear first. Any characters in the set except the hyphen, a-z, A-Z, and 0-9 must be preceded by a backslash (`\`). For example, `"[a-z13579\.]+"` would restrict usernames to lowercase letters, odd digits, and periods, while `"[-a-zA-Z0-9]+"` would allow basic alphanumeric characters and hyphens.
manager:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: The `displayName` of the User's manager
managerId:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: The `id` of the User's manager
middleName:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Middle name(s) of the User
mobilePhone:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Mobile phone number of the User
nickName:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Casual way to address the User in real life
organization:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Name of the User's organization
postalAddress:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Mailing address component of the User's address
preferredLanguage:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "User's preferred written or spoken languages. This property\
\ is formatted according to [RFC 7231 Section 5.3.5](https://tools.ietf.org/html/rfc7231#section-5.3.5)."
primaryPhone:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "Primary phone number of the User, such as home number"
profileUrl:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "URL of the User's online Profile (for example, a web page.)\
\ This property is formatted according to the [Relative Uniform Resource\
\ Locators specification](https://tools.ietf.org/html/draft-ietf-scim-core-schema-22#ref-ISO3166)."
secondEmail:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "Secondary email address of the User typically used for account\
\ recovery. This property is formatted according to [RFC 5322 Section\
\ 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
state:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: State or region component of the User's address (`region`)
streetAddress:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: Full street address component of the User's address
timezone:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "User's time zone. This property is formatted according to\
\ the [IANA Time Zone database format](https://tools.ietf.org/html/rfc6557)."
title:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: "User's title, such as \"Vice President\""
userType:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: |-
Used to describe the organization to the User relationship such as "Employee" or "Contractor".
**Note:** The `userType` field is an arbitrary string value and isn't related to the newer [User Types](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/) feature.
zipCode:
allOf:
- $ref: '#/components/schemas/UserSchemaAttribute'
description: ZIP code or postal code component of the User's address (`postalCode`)
type: object
UserSchemaDefinitions:
properties:
base:
$ref: '#/components/schemas/UserSchemaBase'
custom:
$ref: '#/components/schemas/UserSchemaPublic'
type: object
UserSchemaProperties:
example:
profile:
allOf:
- $ref: $ref
- $ref: $ref
properties:
profile:
$ref: '#/components/schemas/UserSchemaPropertiesProfile'
type: object
UserSchemaPropertiesProfile:
example:
allOf:
- $ref: $ref
- $ref: $ref
properties:
allOf:
items:
$ref: '#/components/schemas/UserSchemaPropertiesProfileItem'
type: array
type: object
UserSchemaPropertiesProfileItem:
example:
$ref: $ref
properties:
$ref:
type: string
type: object
UserSchemaPublic:
description: All custom Profile properties are defined in a Profile subschema
with the resolution scope `#custom`
properties:
id:
description: The subschema name
readOnly: true
type: string
properties:
additionalProperties:
$ref: '#/components/schemas/UserSchemaAttribute'
description: The `#custom` object properties
type: object
required:
description: A collection indicating required property names
items:
type: string
readOnly: true
type: array
type:
description: The object type
readOnly: true
type: string
type: object
UserStatus:
description: |-
The current status of the user.
The status of a User changes in response to explicit events, such as admin-driven lifecycle changes, user login, or self-service password recovery. Okta doesn't asynchronously sweep through users and update their password expiry state, for example. Instead, Okta evaluates password policy at login time, notices the password has expired, and moves the User to the expired state. When running reports, remember that the data is valid as of the last login or lifecycle event for that user.
enum:
- ACTIVE
- DEPROVISIONED
- LOCKED_OUT
- PASSWORD_EXPIRED
- PROVISIONED
- RECOVERY
- STAGED
- SUSPENDED
readOnly: true
type: string
UserStatusPolicyRuleCondition:
properties:
value:
$ref: '#/components/schemas/PolicyUserStatus'
type: object
UserType:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
properties:
created:
description: A timestamp from when the User Type was created
format: date-time
readOnly: true
type: string
createdBy:
description: The user ID of the account that created the User Type
readOnly: true
type: string
default:
description: A boolean value to indicate if this is the default User Type
readOnly: true
type: boolean
description:
description: The human-readable description of the User Type
type: string
displayName:
description: The human-readable name of the User Type
type: string
id:
description: The unique key for the User Type
type: string
lastUpdated:
description: A timestamp from when the User Type was most recently updated
format: date-time
readOnly: true
type: string
lastUpdatedBy:
description: The user ID of the most recent account to edit the User Type
readOnly: true
type: string
name:
description: "The name of the User Type. The name must start with A-Z or\
\ a-z and contain only A-Z, a-z, 0-9, or underscore (_) characters. This\
\ value becomes read-only after creation and can't be updated."
type: string
_links:
$ref: '#/components/schemas/UserTypeLinks'
required:
- displayName
- name
type: object
UserTypeCondition:
description: <x-lifecycle class="oie"></x-lifecycle> Specifies which User Types
to include and/or exclude
properties:
exclude:
description: The User Types to exclude
items:
type: string
type: array
include:
description: The User Types to include
items:
type: string
type: array
required:
- exclude
- include
UserTypeLinks:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
schema:
$ref: '#/components/schemas/UserTypeLinks_allOf_schema'
type: object
example:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
UserTypePostRequest:
example:
displayName: displayName
description: description
properties:
description:
description: The updated human-readable description of the User Type
type: string
displayName:
description: The updated human-readable display name for the User Type
type: string
type: object
UserTypePutRequest:
example:
displayName: displayName
name: name
description: description
properties:
description:
description: The human-readable description of the User Type
type: string
displayName:
description: The human-readable name of the User Type
type: string
name:
description: The name of the existing type
type: string
required:
- description
- displayName
- name
type: object
UserVerificationEnum:
description: "User verification setting. Possible values `DISCOURAGED` (the\
\ authenticator isn't asked to perform user verification, but may do so at\
\ its discretion), `PREFERRED` (the client uses an authenticator capable of\
\ user verification if possible), or `REQUIRED`(the client uses only an authenticator\
\ capable of user verification)"
enum:
- DISCOURAGED
- PREFERRED
- REQUIRED
type: string
UsersLink:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Application Users](/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
VerificationMethod:
description: "Describes the method for verifying the user. The supported method\
\ types are `ASSURANCE` and `AUTH_METHOD_CHAIN`.\n\n <x-lifecycle class=\"\
ea\"></x-lifecycle> The method type `AUTH_METHOD_CHAIN` is an [Early Access](https://developer.okta.com/docs/api/openapi/okta-management/guides/release-lifecycle/#early-access-ea)\
\ (Self-Service) feature. You can \nenable the feature for your org from the\
\ **Settings** > **Features** page in the Admin Console."
discriminator:
mapping:
ASSURANCE: '#/components/schemas/AssuranceMethod'
AUTH_METHOD_CHAIN: '#/components/schemas/AuthenticationMethodChainMethod'
propertyName: type
properties:
type:
$ref: '#/components/schemas/PolicyRuleVerificationMethodType'
type: object
Version:
description: "The version specified as a [Semantic Version](https://semver.org/)."
pattern: "^(0|[1-9]\\d*)\\.(0|[1-9]\\d*)\\.(0|[1-9]\\d*)(?:-((?:0|[1-9]\\d*|\\\
d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\\.(?:0|[1-9]\\d*|\\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\\\
+([0-9a-zA-Z-]+(?:\\.[0-9a-zA-Z-]+)*))?$"
type: string
WebAuthnAttachment:
description: Method attachment
enum:
- ANY
- BUILT_IN
- ROAMING
type: string
WebAuthnCredRequest:
description: "Credential request object for the initialized credential, along\
\ with the enrollment and key identifiers to associate with the credential"
example:
credRequestJwe: credRequestJwe
keyId: keyId
authenticatorEnrollmentId: authenticatorEnrollmentId
properties:
authenticatorEnrollmentId:
description: ID for a WebAuthn Preregistration Factor in Okta
type: string
credRequestJwe:
description: Encrypted JWE of credential request for the fulfillment provider
type: string
keyId:
description: ID for the Okta response key-pair used to encrypt and decrypt
credential requests and responses
type: string
type: object
WebAuthnCredResponse:
description: "Credential response object for enrolled credential details, along\
\ with enrollment and key identifiers to associate the credential"
example:
credResponseJWE: credResponseJWE
authenticatorEnrollmentId: authenticatorEnrollmentId
properties:
authenticatorEnrollmentId:
description: ID for a WebAuthn Preregistration Factor in Okta
type: string
credResponseJWE:
description: Encrypted JWE of credential response from the fulfillment provider
type: string
type: object
WebAuthnPreregistrationFactor:
description: User Factor variant used for WebAuthn Preregistration Factors
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
provider: CUSTOM
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile: "{}"
factorType: call
id: id
vendorName: OKTA
status: ACTIVE
properties:
created:
description: Timestamp indicating when the Factor was enrolled
format: date-time
readOnly: true
type: string
factorType:
$ref: '#/components/schemas/UserFactorType'
id:
description: ID of the Factor
readOnly: true
type: string
lastUpdated:
description: Timestamp indicating when the Factor was last updated
format: date-time
readOnly: true
type: string
profile:
description: Specific attributes related to the Factor
type: object
provider:
$ref: '#/components/schemas/UserFactorProvider'
status:
$ref: '#/components/schemas/UserFactorStatus'
vendorName:
description: Name of the Factor vendor. This is usually the same as the
provider.
example: OKTA
readOnly: true
type: string
_links:
$ref: '#/components/schemas/LinksSelf'
type: object
WellKnownAppAuthenticatorConfiguration:
example:
lastUpdated: 2000-01-23T04:56:07.000+00:00
settings:
userVerification: PREFERRED
createdDate: 2000-01-23T04:56:07.000+00:00
supportedMethods:
- settings:
algorithms:
- ES256
- ES256
transactionTypes:
- CIBA
- CIBA
keyProtection: ANY
type: push
status: ACTIVE
- settings:
algorithms:
- ES256
- ES256
transactionTypes:
- CIBA
- CIBA
keyProtection: ANY
type: push
status: ACTIVE
name: name
authenticatorId: authenticatorId
appAuthenticatorEnrollEndpoint: appAuthenticatorEnrollEndpoint
type: app
key: custom_app
orgId: orgId
properties:
appAuthenticatorEnrollEndpoint:
description: The authenticator enrollment endpoint
type: string
authenticatorId:
description: The unique identifier of the app authenticator
type: string
createdDate:
description: Timestamp when the Authenticator was created
format: date-time
type: string
key:
$ref: '#/components/schemas/AuthenticatorKeyEnum'
lastUpdated:
description: Timestamp when the Authenticator was last modified
format: date-time
type: string
name:
description: The authenticator display name
type: string
orgId:
description: The `id` of the Okta Org
type: string
settings:
$ref: '#/components/schemas/WellKnownAppAuthenticatorConfiguration_settings'
supportedMethods:
items:
$ref: '#/components/schemas/SupportedMethods'
type: array
type:
description: The type of Authenticator
enum:
- app
type: string
type: object
WellKnownOrgMetadata:
example:
pipeline: idx
settings:
analyticsCollectionEnabled: true
bugReportingEnabled: true
omEnabled: true
_links:
organization:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
alternate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
id: id
properties:
id:
description: The unique identifier of the Org
type: string
pipeline:
$ref: '#/components/schemas/PipelineType'
settings:
$ref: '#/components/schemas/WellKnownOrgMetadataSettings'
_links:
$ref: '#/components/schemas/WellKnownOrgMetadata__links'
type: object
WellKnownOrgMetadataSettings:
example:
analyticsCollectionEnabled: true
bugReportingEnabled: true
omEnabled: true
properties:
analyticsCollectionEnabled:
type: boolean
bugReportingEnabled:
type: boolean
omEnabled:
description: Whether the legacy Okta Mobile application is enabled for the
org
type: boolean
type: object
WellKnownSSFMetadata:
description: Metadata about Okta as a transmitter and relevant information for
configuration.
example:
configuration_endpoint: "https://{yourOktaDomain}/api/v1/ssf/stream"
delivery_methods_supported:
- https://schemas.openid.net/secevent/risc/delivery-method/push
- urn:ietf:rfc:8935
jwks_uri: "https://{yourOktaDomain}/oauth2/v1/keys"
issuer: "https://{yourOktaDomain}"
properties:
configuration_endpoint:
description: The URL of the SSF Stream configuration endpoint
example: "https://{yourOktaDomain}/api/v1/ssf/stream"
format: uri
type: string
delivery_methods_supported:
description: An array of supported SET delivery methods
example:
- https://schemas.openid.net/secevent/risc/delivery-method/push
- urn:ietf:rfc:8935
items:
format: uri
type: string
type: array
issuer:
description: The issuer used in Security Event Tokens. This value is set
as `iss` in the claim.
example: "https://{yourOktaDomain}"
type: string
jwks_uri:
description: The URL of the JSON Web Key Set (JWKS) that contains the signing
keys for validating the signatures of Security Event Tokens (SETs)
example: "https://{yourOktaDomain}/oauth2/v1/keys"
format: uri
type: string
title: Shared Signals Framework Metadata
type: object
WidgetGeneration:
description: The generation of the Sign-in Widget
enum:
- G2
- G3
type: string
WsFederationApplication:
allOf:
- $ref: '#/components/schemas/Application'
- properties:
credentials:
$ref: '#/components/schemas/ApplicationCredentials'
name:
description: '`template_wsfed` is the key name for a WS-Federated app
instance with a SAML 2.0 token'
enum:
- template_wsfed
type: string
settings:
$ref: '#/components/schemas/WsFederationApplicationSettings'
required:
- name
- settings
type: object
x-okta-defined-as:
name: template_wsfed
WsFederationApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- properties:
app:
$ref: '#/components/schemas/WsFederationApplicationSettingsApplication'
type: object
WsFederationApplicationSettingsApplication:
properties:
attributeStatements:
description: "You can federate user attributes such as Okta profile fields,\
\ LDAP, Active Directory, and Workday values. The SP uses the federated\
\ WS-Fed attribute values accordingly."
type: string
audienceRestriction:
description: The entity ID of the SP. Use the entity ID value exactly as
provided by the SP.
type: string
authnContextClassRef:
description: Identifies the SAML authentication context class for the assertion's
authentication statement
type: string
groupFilter:
description: "A regular expression that filters for the User Groups you\
\ want included with the `groupName` attribute. If the matching User Group\
\ has a corresponding AD group, then the attribute statement includes\
\ the value of the attribute specified by `groupValueFormat`. If the matching\
\ User Group doesn't contain a corresponding AD group, then the `groupName`\
\ is used in the attribute statement."
type: string
groupName:
description: The group name to include in the WS-Fed response attribute
statement. This property is used in conjunction with the `groupFilter`
property. Groups that are filtered through the `groupFilter` expression
are included with the `groupName` in the attribute statement. Any users
that belong to the group you've filtered are included in the WS-Fed response
attribute statement.
type: string
groupValueFormat:
description: Specifies the WS-Fed assertion attribute value for filtered
groups. This attribute is only applied to Active Directory groups.
enum:
- windowsDomainQualifiedName
- samAccountName
- dn
type: string
nameIDFormat:
description: The username format that you send in the WS-Fed response
type: string
realm:
description: "The uniform resource identifier (URI) of the WS-Fed app that's\
\ used to share resources securely within a domain. It's the identity\
\ that's sent to the Okta IdP when signing in. See [Realm name](https://help.okta.com/okta_help.htm?type=oie&id=ext_Apps_Configure_Okta_Template_WS_Federation#Realm)."
type: string
siteURL:
description: Launch URL for the web app
type: string
usernameAttribute:
description: Specifies additional username attribute statements to include
in the WS-Fed assertion
enum:
- username
- upn
- upnAndUsername
- none
type: string
wReplyOverride:
description: Enables a web app to override the `wReplyURL` URL with a reply
parameter.
type: boolean
wReplyURL:
description: The WS-Fed SP endpoint where your users sign in
example: http://test.acme.com/example-post-sign/
type: string
required:
- audienceRestriction
- authnContextClassRef
- groupValueFormat
- nameIDFormat
- siteURL
- usernameAttribute
- wReplyURL
type: object
X5c:
description: Base64-encoded X.509 certificate chain with DER encoding
items:
example: MIIDnjCCAoagAwIBAgIGAVG3MN+PMA0GCSqGSIb3DQEBBQUAMIGPMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzENMAsGA1UECgwET2t0YTEUMBIGA1UECwwLU1NPUHJvdmlkZXIxEDAOBgNVBAMMB2V4YW1wbGUxHDAaBgkqhkiG9w0BCQEWDWluZm9Ab2t0YS5jb20wHhcNMTUxMjE4MjIyMjMyWhcNMjUxMjE4MjIyMzMyWjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xDTALBgNVBAoMBE9rdGExFDASBgNVBAsMC1NTT1Byb3ZpZGVyMRAwDgYDVQQDDAdleGFtcGxlMRwwGgYJKoZIhvcNAQkBFg1pbmZvQG9rdGEuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtcnyvuVCrsFEKCwHDenS3Ocjed8eWDv3zLtD2K/iZfE8BMj2wpTfn6Ry8zCYey3mWlKdxIybnV9amrujGRnE0ab6Q16v9D6RlFQLOG6dwqoRKuZy33Uyg8PGdEudZjGbWuKCqqXEp+UKALJHV+k4wWeVH8g5d1n3KyR2TVajVJpCrPhLFmq1Il4G/IUnPe4MvjXqB6CpKkog1+ThWsItPRJPAM+RweFHXq7KfChXsYE7Mmfuly8sDQlvBmQyxZnFHVuiPfCvGHJjpvHy11YlHdOjfgqHRvZbmo30+y0X/oY/yV4YEJ00LL6eJWU4wi7ViY3HP6/VCdRjHoRdr5L/DwIDAQABMA0GCSqGSIb3DQEBBQUAA4IBAQCzzhOFkvyYLNFj2WDcq1YqD4sBy1iCia9QpRH3rjQvMKDwQDYWbi6EdOX0TQ/IYR7UWGj+2pXd6v0t33lYtoKocp/4lUvT3tfBnWZ5KnObi+J2uY2teUqoYkASN7F+GRPVOuMVoVgm05ss8tuMb2dLc9vsx93sDt+XlMTv/2qi5VPwaDtqduKkzwW9lUfn4xIMkTiVvCpe0X2HneD2Bpuao3/U8Rk0uiPfq6TooWaoW3kjsmErhEAs9bA7xuqo1KKY9CdHcFhkSsMhoeaZylZHtzbnoipUlQKSLMdJQiiYZQ0bYL83/Ta9fulr1EERICMFt3GUmtYaZZKHpWSfdJp9
type: string
type: array
ZoomUsApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- zoomus
example: zoomus
type: string
signOnMode:
enum:
- SAML_2_0
type: string
settings:
$ref: '#/components/schemas/ZoomUsApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for the Zoom app (key name: `zoomus`)
To create a Zoom app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Zoom app only supports `SAML_2_0` sign-on mode.
example:
name: zoomus
label: Sample Zoom App
signOnMode: SAML_2_0
settings:
app:
subDomain: my-zoom-subdomain
title: Zoom
x-tags:
- Application
x-okta-defined-as:
name: zoomus
ZoomUsApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/ZoomUsApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
ZoomUsApplicationSettingsApplication:
description: Zoom app instance properties
properties:
subDomain:
description: Your Zoom subdomain
type: string
required:
- subDomain
type: object
ZscalerbyzApplication:
allOf:
- $ref: '#/components/schemas/OINApplication'
- type: object
- properties:
name:
enum:
- zscalerbyz
example: zscalerbyz
type: string
signOnMode:
enum:
- BROWSER_PLUGIN
- SAML_2_0
type: string
settings:
$ref: '#/components/schemas/ZscalerbyzApplicationSettings'
required:
- label
- name
- settings
description: |
Schema for the Zscaler 2.0 app (key name: `zscalerbyz`)
To create a Zscaler 2.0 app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.
> **Note:** The Zscaler 2.0 app only supports `BROWSER_PLUGIN` and `SAML_2_0` sign-on modes.
example:
name: zscalerbyz
label: Sample Zscaler 2.0 App
signOnMode: SAML_2_0
title: Zscaler 2.0
x-tags:
- Application
x-okta-defined-as:
name: zscalerbyz
ZscalerbyzApplicationSettings:
allOf:
- $ref: '#/components/schemas/ApplicationSettings'
- type: object
- properties:
app:
$ref: '#/components/schemas/ZscalerbyzApplicationSettingsApplication'
signOn:
$ref: '#/components/schemas/OINSaml20ApplicationSettingsSignOn'
required:
- app
ZscalerbyzApplicationSettingsApplication:
description: Zscaler app instance properties
properties:
siteDomain:
description: Your Zscaler domain
type: string
type: object
_embedded:
description: The Public Key Details are defined in the `_embedded` property
of the Key object.
example:
kty: kty
e: e
use: use
kid: kid
alg: alg
"n": "n"
properties:
alg:
description: Algorithm used in the key
nullable: false
readOnly: true
type: string
e:
description: RSA key value (exponent) for key binding
nullable: false
readOnly: true
type: string
kid:
description: Unique identifier for the certificate
nullable: false
readOnly: true
type: string
uniqueItems: true
kty:
description: Cryptographic algorithm family for the certificate's keypair
nullable: false
readOnly: true
type: string
"n":
description: RSA key value (modulus) for key binding
nullable: false
readOnly: true
type: string
use:
description: Acceptable use of the certificate
nullable: true
readOnly: true
type: string
type: object
appLink:
properties:
login:
$ref: '#/components/schemas/HrefObjectAppLink'
logo:
$ref: '#/components/schemas/HrefObjectLogoLink'
readOnly: true
type: object
createdProperty:
description: Timestamp when the object was created
example: 2017-03-28T01:11:10Z
format: date-time
readOnly: true
type: string
enabledPagesType:
enum:
- SIGN_IN
- SSPR
- SSR
title: enabledPages
type: string
x-enumDescriptions:
SIGN_IN: User sign-in page
SSPR: Self-service Password Recovery page
SSR: Self-service Registration page
lastUpdatedProperty:
description: Timestamp when the object was last updated
format: date-time
readOnly: true
type: string
orgBillingContactType:
description: Org billing contact
properties:
contactType:
$ref: '#/components/schemas/OrgContactType'
_links:
$ref: '#/components/schemas/orgBillingContactType__links'
type: object
orgGeneralSettingLinks:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the org using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
example:
preferences:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
oktaCommunication:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
uploadLogo:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
oktaSupport:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
contacts:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
contacts:
$ref: '#/components/schemas/orgGeneralSettingLinks_contacts'
logo:
$ref: '#/components/schemas/orgGeneralSettingLinks_logo'
oktaCommunication:
$ref: '#/components/schemas/orgGeneralSettingLinks_oktaCommunication'
oktaSupport:
$ref: '#/components/schemas/orgGeneralSettingLinks_oktaSupport'
preferences:
$ref: '#/components/schemas/orgGeneralSettingLinks_preferences'
uploadLogo:
$ref: '#/components/schemas/orgGeneralSettingLinks_uploadLogo'
readOnly: true
type: object
orgTechnicalContactType:
description: Org technical contact
properties:
contactType:
$ref: '#/components/schemas/OrgContactType'
_links:
$ref: '#/components/schemas/orgTechnicalContactType__links'
type: object
postAPIServiceIntegrationInstance:
allOf:
- $ref: '#/components/schemas/APIServiceIntegrationInstance'
- properties:
clientSecret:
description: The client secret for the API Service Integration instance.
This property is only returned in a POST response.
readOnly: true
type: string
type: object
example:
createdAt: 2023-02-21T20:08:24.000Z
grantedScopes:
- okta.logs.read
createdBy: 00uu3u0ujW1P6AfZC2d5
_links:
client:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
name: My App Cloud Identity Engine
clientSecret: clientSecret
id: 0oa72lrepvp4WqEET1d9
type: my_app_cie
configGuideUrl: "https://{docDomain}/my-app-cie/configuration-guide"
postAPIServiceIntegrationInstanceRequest:
properties:
grantedScopes:
description: "The list of Okta management scopes granted to the API Service\
\ Integration instance. See [Okta management OAuth 2.0 scopes](/oauth2/#okta-admin-management)."
example:
- okta.logs.read
items:
type: string
type: array
type:
description: "The type of the API service integration. This string is an\
\ underscore-concatenated, lowercased API service integration name. For\
\ example, `my_api_log_integration`."
example: my_app_cie
type: string
required:
- grantedScopes
- type
type: object
profile:
additionalProperties:
properties: {}
type: object
description: Specific profile properties for the privileged account
readOnly: true
type: object
subject:
nullable: false
properties:
format:
description: The user identifier
enum:
- opaque
nullable: false
type: string
writeOnly: true
id:
description: ID of the user
nullable: false
type: string
writeOnly: true
type: object
userLink:
properties:
user:
$ref: '#/components/schemas/HrefObjectUserLink'
type: object
schemas-JsonWebKey:
description: "A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is\
\ a JSON representation of a cryptographic key. Okta can use these keys to\
\ verify the signature of a JWT when provided for the `private_key_jwt` client\
\ authentication method or for a signed authorize request object. Okta supports\
\ both RSA and Elliptic Curve (EC) keys."
discriminator:
mapping:
EC: '#/components/schemas/JsonWebKeyEC'
RSA: '#/components/schemas/JsonWebKeyRsa'
propertyName: kty
properties:
alg:
$ref: '#/components/schemas/SigningAlgorithm'
kid:
description: The unique identifier of the key
type: string
kty:
$ref: '#/components/schemas/JsonWebKeyType'
status:
$ref: '#/components/schemas/JsonWebKeyStatus'
use:
$ref: '#/components/schemas/JsonWebKeyUse'
type: object
JsonWebKeyEC:
allOf:
- $ref: '#/components/schemas/schemas-JsonWebKey'
- properties:
x:
description: The public x coordinate for the elliptic curve point
type: string
"y":
description: The public y coordinate for the elliptic curve point
type: string
type: object
JsonWebKeyRsa:
allOf:
- $ref: '#/components/schemas/schemas-JsonWebKey'
- properties:
e:
description: The key exponent of a RSA key
type: string
"n":
description: The modulus of the RSA key
type: string
type: object
JsonWebKeyType:
description: The type of public key
enum:
- EC
- RSA
type: string
JsonWebKeyStatus:
description: The status of the public key
enum:
- ACTIVE
- INACTIVE
type: string
JsonWebKeyUse:
description: The intended use of the public key
enum:
- enc
- sig
type: string
updateDefaultProvisioningConnectionForApplication_request:
oneOf:
- $ref: '#/components/schemas/ProvisioningConnectionTokenRequest'
- $ref: '#/components/schemas/ProvisioningConnectionOauthRequest'
updateFeatureForApplication_request:
oneOf:
- $ref: '#/components/schemas/CapabilitiesObject'
- $ref: '#/components/schemas/CapabilitiesInboundProvisioningObject'
uploadApplicationLogo_request:
properties:
file:
description: |
The image file containing the logo.
The file must be in PNG, JPG, SVG, or GIF format, and less than one MB in size.
For best results, use an image with a transparent background and a square dimension of 200 x 200 pixels to prevent upscaling.
format: binary
type: string
required:
- file
type: object
uploadBrandThemeBackgroundImage_request:
description: "The file must be in PNG, JPG, or GIF format and less than 2 MB\
\ in size."
properties:
file:
format: binary
type: string
required:
- file
type: object
uploadBrandThemeFavicon_request:
description: The file must be in PNG or ICO format and have a 1:1 ratio with
a maximum dimension of 512 x 512
properties:
file:
format: binary
type: string
required:
- file
type: object
uploadBrandThemeLogo_request:
description: "The file must be in PNG, JPG, or GIF format and less than 100kB\
\ in size. For best results use landscape orientation, a transparent background,\
\ and a minimum size of 300px by 50px to prevent upscaling."
properties:
file:
format: binary
type: string
required:
- file
type: object
addGroup_request:
properties:
profile:
$ref: '#/components/schemas/OktaUserGroupProfile'
listGroupAssignedRoles_200_response_inner:
oneOf:
- $ref: '#/components/schemas/StandardRole'
- $ref: '#/components/schemas/CustomRole'
assignRoleToGroup_request:
oneOf:
- $ref: '#/components/schemas/StandardRoleAssignmentSchema'
- $ref: '#/components/schemas/CustomRoleAssignmentSchema'
uploadYubikeyOtpTokenSeed_request:
properties:
serialNumber:
description: The unique identifier assigned to each YubiKey device
type: string
publicId:
description: The Yubikey's public ID
type: string
privateId:
description: The Yubikey's private ID
type: string
aesKey:
description: The cryptographic key used in the AES algorithm to encrypt
and decrypt YubiKey OTP
type: string
type: object
uploadOrgLogo_request:
properties:
file:
description: "The file must be in PNG, JPG, or GIF format and less than\
\ 1 MB in size. For best results use landscape orientation, a transparent\
\ background, and a minimum size of 420px by 120px to prevent upscaling."
format: binary
type: string
required:
- file
type: object
listSubscriptionsRole_roleRef_parameter:
oneOf:
- $ref: '#/components/schemas/RoleType'
- title: roleId
type: string
getSsfStreams_200_response:
oneOf:
- items:
$ref: '#/components/schemas/StreamConfiguration'
title: List of Stream Configurations
type: array
- $ref: '#/components/schemas/StreamConfiguration'
assignRoleToUser_request:
oneOf:
- $ref: '#/components/schemas/StandardRoleAssignmentSchema'
- $ref: '#/components/schemas/CustomRoleAssignmentSchema'
type: object
assignRoleToUser_201_response:
oneOf:
- $ref: '#/components/schemas/StandardRole'
- $ref: '#/components/schemas/CustomRole'
type: object
ApiToken_network:
description: The Network Condition of the API Token
example:
include:
- include
- include
connection: connection
exclude:
- exclude
- exclude
properties:
connection:
description: The connection type of the Network Condition
type: string
include:
description: List of included IP network zones
items:
type: string
type: array
exclude:
description: List of excluded IP network zones
items:
type: string
type: array
type: object
AppCustomHrefObject_hints:
description: Describes allowed HTTP verbs for the `href`
properties:
allow:
items:
type: string
type: array
type: object
Application__embedded:
description: "Embedded resources related to the app using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. If the `expand=user/{userId}` query parameter is specified,\
\ then the assigned [Application User](/openapi/okta-management/management/tag/ApplicationUsers/)\
\ is embedded."
example:
user:
key: "{}"
properties:
user:
additionalProperties:
properties: {}
type: object
description: "The specified [Application User](/openapi/okta-management/management/tag/ApplicationUsers/)\
\ assigned to the app"
type: object
readOnly: true
type: object
ApplicationFeature__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- readOnly: true
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ApplicationGroupAssignment__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
app:
$ref: '#/components/schemas/HrefObjectAppLink'
group:
$ref: '#/components/schemas/HrefObjectGroupLink'
type: object
example:
app:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
group:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ApplicationLayout_rule:
properties:
effect:
type: string
condition:
$ref: '#/components/schemas/ApplicationLayoutRuleCondition'
type: object
ApplicationLayouts__links:
properties:
general:
items:
$ref: '#/components/schemas/HrefObject'
type: array
signOn:
items:
$ref: '#/components/schemas/HrefObject'
type: array
provisioning:
items:
$ref: '#/components/schemas/HrefObject'
type: array
readOnly: true
type: object
AuthServerLinks_allOf_claims:
allOf:
- description: Link to the authorization server claims
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
AuthServerLinks_allOf_policies:
allOf:
- description: Link to the authorization server policies
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
AuthServerLinks_allOf_rotateKey:
allOf:
- description: Link to the authorization server key rotation
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
AuthServerLinks_allOf_scopes:
allOf:
- description: Link to the authorization server scopes
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
AuthenticatorEnrollmentPolicyAuthenticatorSettings_constraints:
description: Constraints for the authenticator
minimum: 0
nullable: true
properties:
aaguidGroups:
description: The list of FIDO2 WebAuthn authenticator groups allowed for
enrollment
items:
type: string
uniqueItems: true
type: array
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
AuthenticatorEnrollmentPolicyAuthenticatorSettings_enroll:
description: Enrollment requirements for the authenticator
properties:
self:
$ref: '#/components/schemas/AuthenticatorEnrollmentPolicyAuthenticatorStatus'
type: object
AuthenticatorEnrollmentPolicyConditions_allOf_people_groups:
description: Specifies a set of Groups whose Users are to be included or excluded
properties:
include:
description: Groups to be included
items:
type: string
type: array
type: object
AuthenticatorEnrollmentPolicyConditions_allOf_people:
description: Identifies Users and Groups that are used together
properties:
groups:
$ref: '#/components/schemas/AuthenticatorEnrollmentPolicyConditions_allOf_people_groups'
type: object
AuthenticatorEnrollmentPolicyRuleConditions_people_users:
description: Specifies a set of Users to be included or excluded
properties:
exclude:
description: Users to be excluded
items:
type: string
type: array
type: object
AuthenticatorEnrollmentPolicyRuleConditions_people:
description: Identifies Users and Groups that are used together
properties:
users:
$ref: '#/components/schemas/AuthenticatorEnrollmentPolicyRuleConditions_people_users'
type: object
AuthenticatorKeyCustomApp_allOf_provider_configuration_apns:
properties:
id:
description: "ID of the APNs (Apple Push Notification Service) [configurations](https://developer.okta.com/docs/reference/api/push-providers/)"
type: string
appBundleId:
description: "AppBundleId of the APNs (Apple Push Notification Service)\
\ [configurations](https://developer.okta.com/docs/reference/api/push-providers/)"
type: string
debugAppBundleId:
description: "DebugAppBundleId of the APNs (Apple Push Notification Service)\
\ [configurations](https://developer.okta.com/docs/reference/api/push-providers/)"
type: string
type: object
AuthenticatorKeyCustomApp_allOf_provider_configuration_fcm:
properties:
id:
description: "ID of the FCM (Firebase Cloud Messaging Service) [configurations](https://developer.okta.com/docs/reference/api/push-providers/)"
type: string
type: object
AuthenticatorKeyCustomApp_allOf_provider_configuration:
description: The configuration of the provider
properties:
apns:
$ref: '#/components/schemas/AuthenticatorKeyCustomApp_allOf_provider_configuration_apns'
fcm:
$ref: '#/components/schemas/AuthenticatorKeyCustomApp_allOf_provider_configuration_fcm'
type: object
AuthenticatorKeyCustomApp_allOf_provider:
properties:
type:
description: Provider type
enum:
- PUSH
type: string
configuration:
$ref: '#/components/schemas/AuthenticatorKeyCustomApp_allOf_provider_configuration'
type: object
AuthenticatorKeyCustomApp_allOf_settings:
properties:
userVerification:
$ref: '#/components/schemas/CustomAppUserVerificationEnum'
appInstanceId:
description: "The application instance ID. For custom_app, you need to create\
\ an OIDC native app using the [Apps API](https://developer.okta.com/docs/reference/api/apps/)\
\ with `Authorization Code` and `Refresh Token` grant types. You can leave\
\ both `Sign-in redirect URIs` and `Sign-out redirect URIs` as the default\
\ values."
type: string
type: object
AuthenticatorKeyDuo_allOf_provider_configuration_userNameTemplate:
properties:
template:
description: The Duo Security user template name
type: string
type: object
AuthenticatorKeyDuo_allOf_provider_configuration:
properties:
host:
description: The Duo Security API hostname
type: string
integrationKey:
description: The Duo Security integration key
type: string
secretKey:
description: The Duo Security secret key
type: string
userNameTemplate:
$ref: '#/components/schemas/AuthenticatorKeyDuo_allOf_provider_configuration_userNameTemplate'
type: object
AuthenticatorKeyDuo_allOf_provider:
properties:
type:
description: Provider type
enum:
- DUO
type: string
configuration:
$ref: '#/components/schemas/AuthenticatorKeyDuo_allOf_provider_configuration'
type: object
AuthenticatorKeyEmail_allOf_settings:
properties:
allowedFor:
$ref: '#/components/schemas/AllowedForEnum'
tokenLifetimeInMinutes:
default: 5
description: Specifies the lifetime of an email token. Default value is
5 minutes.
type: number
type: object
AuthenticatorKeyOktaVerify_allOf_settings:
properties:
channelBinding:
$ref: '#/components/schemas/ChannelBinding'
compliance:
$ref: '#/components/schemas/Compliance'
userVerification:
$ref: '#/components/schemas/UserVerificationEnum'
appInstanceId:
description: The application instance ID
type: string
type: object
AuthenticatorKeyPhone_allOf_settings:
properties:
allowedFor:
$ref: '#/components/schemas/AllowedForEnum'
type: object
AuthenticatorMethodPush_allOf_settings:
properties:
algorithms:
items:
$ref: '#/components/schemas/AuthenticatorMethodAlgorithm'
type: array
keyProtection:
$ref: '#/components/schemas/PushMethodKeyProtection'
transactionTypes:
items:
$ref: '#/components/schemas/AuthenticatorMethodTransactionType'
type: array
type: object
AuthenticatorMethodSignedNonce_allOf_settings:
properties:
algorithms:
items:
$ref: '#/components/schemas/AuthenticatorMethodAlgorithm'
type: array
keyProtection:
$ref: '#/components/schemas/PushMethodKeyProtection'
showSignInWithOV:
$ref: '#/components/schemas/ShowSignInWithOV'
type: object
AuthenticatorMethodTotp_allOf_settings:
properties:
timeIntervalInSeconds:
description: Time interval for TOTP in seconds
type: integer
encoding:
$ref: '#/components/schemas/OtpTotpEncoding'
algorithm:
$ref: '#/components/schemas/OtpTotpAlgorithm'
passCodeLength:
description: Number of digits in an OTP value
maximum: 10
minimum: 6
multipleOf: 2
type: integer
type: object
AuthenticatorMethodWebAuthn_allOf_settings:
properties:
aaguidGroups:
description: <x-lifecycle class="ea"></x-lifecycle> The FIDO2 AAGUID groups
available to the WebAuthn authenticator
items:
$ref: '#/components/schemas/AAGUIDGroupObject'
type: array
userVerification:
$ref: '#/components/schemas/UserVerificationEnum'
attachment:
$ref: '#/components/schemas/WebAuthnAttachment'
type: object
AuthorizationServerPolicy_allOf__links_allOf_rules:
allOf:
- description: Link to the authorization server policy's rules
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
AuthorizationServerPolicy_allOf__links:
allOf:
- $ref: '#/components/schemas/LinksSelfAndLifecycle'
- properties:
rules:
$ref: '#/components/schemas/AuthorizationServerPolicy_allOf__links_allOf_rules'
type: object
example:
activate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
rules:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
BaseContext_session:
description: Details of the user session
properties:
id:
description: The unique identifier for the user's session
example: 102LN9Bnuc4S_ewfc9BYwageA
type: string
userId:
description: The unique identifier for the user
example: 00uq8tMo3zV0OfJON0g3
type: string
login:
description: The username used to identify the user. This is often the user's
email address.
example: user@example.com
type: string
createdAt:
description: Timestamp of when the session was created
example: 2019-03-28T16:45:55Z
format: date-time
type: string
expiresAt:
description: Timestamp of when the session expires
example: 2019-03-28T21:15:23Z
format: date-time
type: string
status:
description: Represents the current status of the user's session
example: ACTIVE
type: string
lastPasswordVerification:
description: Timestamp of when the user was last authenticated
example: 2019-03-28T16:45:55Z
format: date-time
type: string
amr:
description: The authentication method reference
items:
example: "[\"PASSWORD\"]"
type: string
type: array
idp:
$ref: '#/components/schemas/SessionIdentityProvider'
mfaActive:
description: Describes whether multifactor authentication was enabled
example: false
type: boolean
type: object
BaseContext_user_profile:
properties:
login:
description: The username used to identify the user. This is often the user's
email address.
example: user@example.com
type: string
firstName:
description: The first name of the user
example: John
type: string
lastName:
description: The last name of the user
example: Smith
type: string
locale:
description: |-
The user's default location for purposes of localizing items such as currency, date time format, numerical representations, and so on.
A locale value is a concatenation of the [ISO 639-1](https://en.wikipedia.org/wiki/List_of_ISO_639_language_codes) two-letter language code, an underscore, and the [ISO 3166-1](https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2) two-letter country code. For example, `en_US` specifies the language English and country US. This value is `en_US` by default.
example: en_US
type: string
timeZone:
description: The user's timezone
example: America/Los_Angeles
type: string
type: object
BaseContext_user__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of the user. These links are used to discover\
\ what groups the user is a part of and what factors they have enrolled."
properties:
groups:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to retrieve the individual user's group memberships
factors:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to retrieve individual user's factor enrollments
type: object
BaseContext_user:
description: Identifies the Okta user that the token was generated to authenticate
and provides details of their Okta user profile
properties:
id:
description: The unique identifier for the user
example: 00uq8tMo3zV0OfJON0g3
type: string
passwordChanged:
description: The timestamp when the user's password was last updated
example: 2018-09-11T23:19:12Z
format: date-time
type: string
profile:
$ref: '#/components/schemas/BaseContext_user_profile'
_links:
$ref: '#/components/schemas/BaseContext_user__links'
type: object
BaseToken_lifetime:
description: Lifetime of the token
properties:
expiration:
description: Time in seconds until the token expires
type: integer
type: object
BulkUpsertRequestBody_profiles_inner:
example:
profile:
firstName: firstName
lastName: lastName
mobilePhone: mobilePhone
secondEmail: secondEmail
userName: userName
email: email
homeAddress: homeAddress
externalId: externalId
properties:
externalId:
description: The external ID of the entity that needs to be created or updated
in Okta
maxLength: 512
type: string
profile:
$ref: '#/components/schemas/IdentitySourceUserProfileForUpsert'
type: object
BundleEntitlement__links:
allOf:
- properties:
values:
$ref: '#/components/schemas/HrefObject'
BundleEntitlementsResponse__links_next:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the next resource
BundleEntitlementsResponse__links_bundle:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the bundle resource
BundleEntitlementsResponse__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
properties:
next:
$ref: '#/components/schemas/BundleEntitlementsResponse__links_next'
self:
$ref: '#/components/schemas/HrefObjectSelfLink'
bundle:
$ref: '#/components/schemas/BundleEntitlementsResponse__links_bundle'
readOnly: true
type: object
CaepDeviceComplianceChangeEvent_reason_admin:
allOf:
- $ref: '#/components/schemas/SecurityEventReason'
- description: A localized administrative message intended for logging and auditing.<br>Either
`reason_admin` or `reason_user` is required.
type: object
CaepDeviceComplianceChangeEvent_reason_user:
allOf:
- $ref: '#/components/schemas/SecurityEventReason'
- description: A localized message intended for the end user.<br>Either `reason_admin`
or `reason_user` is required.
type: object
CreateUserRequest_type:
description: |-
The ID of the User type. Add this value if you want to create a User with a non-default [User Type](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserType/).
The User Type determines which [schema](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Schema/) applies to that user. After a User has been created, the User can
only be assigned a different User Type by an administrator through a full replacement (`PUT`) operation.
example:
id: id
properties:
id:
description: The ID of the User Type
type: string
type: object
DeviceAssuranceAndroidPlatform_allOf_diskEncryptionType:
properties:
include:
items:
$ref: '#/components/schemas/DiskEncryptionTypeAndroid'
type: array
type: object
DeviceAssuranceAndroidPlatform_allOf_screenLockType:
properties:
include:
items:
$ref: '#/components/schemas/ScreenLockType'
type: array
type: object
DeviceAssuranceChromeOSPlatform_allOf_thirdPartySignalProviders:
description: Settings for third-party signal providers (based on the `CHROMEOS`
platform)
properties:
dtc:
$ref: '#/components/schemas/DTCChromeOS'
type: object
DeviceAssuranceMacOSPlatform_allOf_diskEncryptionType:
properties:
include:
items:
$ref: '#/components/schemas/DiskEncryptionTypeDesktop'
type: array
type: object
DeviceAssuranceMacOSPlatform_allOf_thirdPartySignalProviders:
description: Settings for third-party signal providers (based on the `MACOS`
platform)
properties:
dtc:
$ref: '#/components/schemas/DTCMacOS'
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceAssuranceWindowsPlatform_allOf_thirdPartySignalProviders:
description: Settings for third-party signal providers (based on the `WINDOWS`
platform)
properties:
dtc:
$ref: '#/components/schemas/DTCWindows'
type: object
x-okta-lifecycle:
lifecycle: GA
isGenerallyAvailable: false
SKUs: []
DeviceList_allOf__embedded:
description: List of associated users for the device if the `expand=user` query
parameter is specified in the request. Use `expand=userSummary` to get only
a summary of each associated user for the device.
example:
users:
- managementStatus: MANAGED
created: created
screenLockType: NONE
user:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
- managementStatus: MANAGED
created: created
screenLockType: NONE
user:
lastLogin: 2000-01-23T04:56:07.000+00:00
transitioningToStatus: null
realmId: guo1bfiNtSnZYILxO0g4
credentials:
password:
hook:
type: type
value: pa$$word
hash:
iterationCount: 0
salt: salt
keySize: 6
saltOrder: saltOrder
workFactor: 3
digestAlgorithm: SHA256_HMAC
value: value
algorithm: BCRYPT
provider:
name: name
type: ACTIVE_DIRECTORY
recovery_question:
answer: se7en
question: what is your favourite movie?
_links:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
created: 2000-01-23T04:56:07.000+00:00
profile:
profileUrl: profileUrl
lastName: lastName
zipCode: zipCode
preferredLanguage: preferredLanguage
city: city
displayName: displayName
timezone: timezone
locale: locale
login: login
title: title
employeeNumber: employeeNumber
division: division
honorificSuffix: honorificSuffix
countryCode: countryCode
state: state
department: department
email: email
manager: manager
costCenter: costCenter
nickName: nickName
secondEmail: secondEmail
honorificPrefix: honorificPrefix
managerId: managerId
firstName: firstName
primaryPhone: primaryPhone
postalAddress: postalAddress
mobilePhone: mobilePhone
streetAddress: streetAddress
organization: organization
middleName: middleName
userType: userType
type:
lastUpdated: 2000-01-23T04:56:07.000+00:00
lastUpdatedBy: lastUpdatedBy
default: true
createdBy: createdBy
_links:
schema:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
displayName: displayName
name: name
description: description
id: id
lastUpdated: 2000-01-23T04:56:07.000+00:00
passwordChanged: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
statusChanged: 2000-01-23T04:56:07.000+00:00
id: id
activated: 2000-01-23T04:56:07.000+00:00
status: ACTIVE
properties:
users:
description: Users for the device
items:
$ref: '#/components/schemas/DeviceUser'
type: array
readOnly: true
type: object
DomainLinks_allOf_brand:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: The associated brand
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
DomainLinks_allOf_certificate:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: The certificate link references the domain certificate
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
DomainLinks_allOf_verify:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: The verify link verifies the domain and transitions the domain
status to `VERIFIED`
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
DynamicNetworkZone_allOf_asns:
allOf:
- $ref: '#/components/schemas/NetworkZoneAsns'
- description: An array of ASNs for a Network Zone
DynamicNetworkZone_allOf_locations:
allOf:
- $ref: '#/components/schemas/NetworkZoneLocationArray'
- description: An array of geolocations for a Dynamic Network Zone
EmailCustomization_allOf__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
self:
$ref: '#/components/schemas/HrefObject'
template:
$ref: '#/components/schemas/HrefObject'
preview:
$ref: '#/components/schemas/HrefObject'
test:
$ref: '#/components/schemas/HrefObject'
example:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
preview:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
test:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
EmailDefaultContent_allOf__links:
type: object
EmailPreview__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
contentSource:
$ref: '#/components/schemas/HrefObject'
template:
$ref: '#/components/schemas/HrefObject'
test:
$ref: '#/components/schemas/HrefObject'
defaultContent:
$ref: '#/components/schemas/HrefObject'
example:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
contentSource:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
defaultContent:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
test:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
EmailSettingsResponse__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
self:
$ref: '#/components/schemas/HrefObject'
template:
$ref: '#/components/schemas/HrefObject'
example:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
EmailTemplateResponse__embedded:
example:
customizationCount: 0
settings:
_links:
template:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
recipients: ALL_USERS
properties:
settings:
$ref: '#/components/schemas/EmailSettingsResponse'
customizationCount:
type: integer
readOnly: true
type: object
EmailTemplateResponse__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
settings:
$ref: '#/components/schemas/HrefObject'
defaultContent:
$ref: '#/components/schemas/HrefObject'
customizations:
$ref: '#/components/schemas/HrefObject'
test:
$ref: '#/components/schemas/HrefObject'
example:
settings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
defaultContent:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
test:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
customizations:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
EnhancedDynamicNetworkZone_allOf_asns_include:
allOf:
- $ref: '#/components/schemas/NetworkZoneAsns'
- description: An array of ASNs to include for an Enhanced Dynamic Network Zone
EnhancedDynamicNetworkZone_allOf_asns:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>The
list of ASNs associated with an Enhanced Dynamic Network Zone
properties:
include:
$ref: '#/components/schemas/EnhancedDynamicNetworkZone_allOf_asns_include'
type: object
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
EnhancedDynamicNetworkZone_allOf_locations_include:
allOf:
- $ref: '#/components/schemas/NetworkZoneLocationArray'
- description: An array of geolocations to include for an Enhanced Dynamic Network
Zone
EnhancedDynamicNetworkZone_allOf_locations_exclude:
allOf:
- $ref: '#/components/schemas/NetworkZoneLocationArray'
- description: An array of geolocations to exclude for an Enhanced Dynamic Network
Zone
EnhancedDynamicNetworkZone_allOf_locations:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>The
list of geolocations to include or exclude for an Enhanced Dynamic Network
Zone
properties:
include:
$ref: '#/components/schemas/EnhancedDynamicNetworkZone_allOf_locations_include'
exclude:
$ref: '#/components/schemas/EnhancedDynamicNetworkZone_allOf_locations_exclude'
type: object
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
EnhancedDynamicNetworkZone_allOf_ipServiceCategories:
description: "<div class=\"x-lifecycle-container\"><x-lifecycle class=\"ea\"\
></x-lifecycle></div>IP services, such as a proxy or VPN, to include or exclude\
\ for an Enhanced Dynamic Network Zone"
properties:
include:
description: IP services to include for an Enhanced Dynamic Network Zone
items:
$ref: '#/components/schemas/IPServiceCategory'
maximum: 75
type: array
exclude:
description: IP services to exclude for an Enhanced Dynamic Network Zone
items:
$ref: '#/components/schemas/IPServiceCategory'
maximum: 75
type: array
type: object
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
EntitlementValue__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
properties:
group:
$ref: '#/components/schemas/HrefObjectGroupLink'
app:
$ref: '#/components/schemas/HrefObjectAppLink'
resource-set:
$ref: '#/components/schemas/HrefObjectResourceSetLink'
readOnly: true
type: object
EntitlementValuesResponse__links:
anyOf:
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksNext'
nullable: true
EntityRiskPolicyRule_allOf_actions_entityRisk:
description: The object that contains the `actions` array
properties:
actions:
description: The `entityRisk` object's `actions` array can be empty or contain
one of two `action` object value pairs. This object determines the specific
response to a risk event.
items:
$ref: '#/components/schemas/EntityRiskPolicyRuleActionsObject'
type: array
type: object
EntityRiskPolicyRule_allOf_actions:
description: The action to take based on the risk event
properties:
entityRisk:
$ref: '#/components/schemas/EntityRiskPolicyRule_allOf_actions_entityRisk'
type: object
EntityRiskPolicyRuleActionRunWorkflow_workflow:
description: This action runs a workflow
properties:
id:
description: The `id` of the workflow that runs.
type: integer
type: object
EventHook__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
deactivate:
$ref: '#/components/schemas/HrefObject'
verify:
$ref: '#/components/schemas/HrefObject'
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
deactivate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
Feature__links_allOf_dependents:
description: Link to feature dependents
example:
href: href
properties:
href:
description: Link URI
readOnly: true
type: string
readOnly: true
type: object
Feature__links_allOf_dependencies:
description: Link to feature dependencies
example:
href: href
properties:
href:
description: Link URI
readOnly: true
type: string
readOnly: true
type: object
Feature__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
dependents:
$ref: '#/components/schemas/Feature__links_allOf_dependents'
dependencies:
$ref: '#/components/schemas/Feature__links_allOf_dependencies'
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
dependents:
href: href
dependencies:
href: href
GovernanceBundle__links:
allOf:
- properties:
entitlements:
$ref: '#/components/schemas/HrefObject'
GovernanceBundlesResponse__links:
anyOf:
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksNext'
Group__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
apps:
$ref: '#/components/schemas/HrefObject'
logo:
items:
$ref: '#/components/schemas/HrefObject'
type: array
source:
$ref: '#/components/schemas/HrefObject'
users:
$ref: '#/components/schemas/HrefObject'
description: "[Discoverable resources](/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!c=200&path=_links&t=response)\
\ related to the Group"
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
GroupSchemaAttribute_enum_inner:
anyOf:
- type: string
- type: integer
IamRole__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
permissions:
$ref: '#/components/schemas/HrefObject'
example:
permissions:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
IdPCsr__links:
additionalProperties: true
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
publish:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: Publish the CSR
example:
publish: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
type: object
IdentityProvider__links:
additionalProperties: true
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
acs:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: SAML 2.0 Assertion Consumer Service URL for the Okta SP
authorize:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: OAuth 2.0 authorization endpoint for the IdP OAuth 2.0 Authorization
Code flow
clientRedirectUri:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: Redirect URI for the OAuth 2.0 Authorization Code flow
metadata:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: "Federation metadata document for the IdP (for example: SAML\
\ 2.0 Metadata)"
users:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: IdP users
deactivate:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: Deactivate IdP
activate:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: Activate IdP
keys:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: IdP keys
example:
acs: ""
metadata: ""
keys: ""
activate: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
clientRedirectUri: ""
authorize: ""
users: ""
deactivate: ""
type: object
IdentityProviderApplicationUser__links:
additionalProperties: true
allOf:
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksNext'
- properties:
idp:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: The IdP instance
example:
href: "https://{yourOktaDomain}/api/v1/idps/0oa1k5d68qR2954hb0g4"
user:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: The linked Okta User
example:
href: "https://{yourOktaDomain}/api/v1/users/00ulwodIu7wCfdiVR0g3"
example:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
idp:
href: "https://{yourOktaDomain}/api/v1/idps/0oa1k5d68qR2954hb0g4"
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
href: "https://{yourOktaDomain}/api/v1/users/00ulwodIu7wCfdiVR0g3"
type: object
IdpPolicyRuleAction_idp:
properties:
providers:
description: List of configured Identity Providers that a given Rule can
route to. Ability to define multiple providers is a part of the Okta Identity
Engine. This allows users to choose a Provider when they sign in. Contact
support for information on the Identity Engine.
items:
$ref: '#/components/schemas/IdpPolicyRuleActionProvider'
type: array
idpSelectionType:
$ref: '#/components/schemas/IdpSelectionType'
matchCriteria:
description: Required if `idpSelectionType` is set to `DYNAMIC`
items:
$ref: '#/components/schemas/IdpPolicyRuleActionMatchCriteria'
type: array
type: object
ImportScheduleObject_fullImport:
allOf:
- $ref: '#/components/schemas/ImportScheduleSettings'
- description: Determines the full import schedule
ImportScheduleObject_incrementalImport:
allOf:
- $ref: '#/components/schemas/ImportScheduleSettings'
- description: Determines the incremental import schedule
InlineHookRequestObject_url:
description: The URL of the API endpoint
properties:
value:
description: The URL value of the API endpoint
type: string
type: object
LinksActivate_activate:
allOf:
- description: "Activates an enrolled Factor. See [Activate a Factor](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/activateFactor)."
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksCancel_cancel:
allOf:
- description: Cancels a `push` factor challenge with a `WAITING` status
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksDeactivate_deactivate:
allOf:
- description: "Deactivates the Factor. See [Unenroll a Factor](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/unenrollFactor)."
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksEnroll_enroll:
allOf:
- description: "Enrolls a supported Factor. See [Enroll a Factor](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/enrollFactor)."
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksFactor_factor:
allOf:
- description: Link to the Factor resource
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksNextForRoleAssignments_next:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "The next page of results if [pagination](#pagination) is required"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksPoll_poll:
allOf:
- description: Polls the Factor resource for status information. Always use
the `poll` link instead of manually constructing your own URL.
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksQrcode_qrcode:
allOf:
- description: QR code that encodes the push activation code needed for enrollment
on the device
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksQuestions_question:
allOf:
- description: "Lists all supported security questions. See [List all Supported\
\ Security Questions](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/listSupportedSecurityQuestions)."
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksResend_resend:
allOf:
- description: "Resends the factor enrollment challenge. See [Resend a Factor\
\ enrollment](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/resendEnrollFactor)."
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksSend_send:
allOf:
- description: Sends an activation link through email or sms for users who can't
scan the QR code
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksUser_user:
allOf:
- description: Returns information on the specified user
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LinksVerify_verify:
allOf:
- description: "Verifies the Factor resource. See [Verify a Factor](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor)."
- $ref: '#/components/schemas/HrefObject'
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
LogTarget_changeDetails:
description: |-
Details on the target's changes. Not all event types support the `changeDetails` property, and not all
`target` objects contain the `changeDetails` property. You must include a property within the object.
> **Note:** When querying the `changeDetails` property, you can't search on the `to` or `from` objects alone. You must include a property within the object.
example:
LogTargetChangeDetails:
$ref: '#/components/examples/LogTargetChangeDetails'
properties:
from:
additionalProperties: true
description: The original properties of the target
type: object
to:
additionalProperties: true
description: The updated properties of the target
type: object
type: object
OAuth2Client__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
grants:
allOf:
- $ref: '#/components/schemas/GrantResourcesHrefObject'
description: Link to the grant resources
tokens:
allOf:
- $ref: '#/components/schemas/TokenResourcesHrefObject'
description: Link to the token resources
type: object
example:
grants: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
tokens: ""
OAuth2RefreshToken__embedded:
description: The embedded resources related to the object if the `expand` query
parameter is specified
example:
scopes:
- _links:
scope: ""
displayName: displayName
name: offline_access
description: "Requests a refresh token by default, used to obtain more access\
\ tokens without re-prompting the user for authentication"
id: scppb56cIl4GvGxy70g3
- _links:
scope: ""
displayName: displayName
name: offline_access
description: "Requests a refresh token by default, used to obtain more access\
\ tokens without re-prompting the user for authentication"
id: scppb56cIl4GvGxy70g3
properties:
scopes:
description: The scope objects attached to the Token
items:
$ref: '#/components/schemas/OAuth2RefreshTokenScope'
type: array
readOnly: true
type: object
OAuth2RefreshToken__links_allOf_revoke_allOf_hints:
example:
allow:
- DELETE
- DELETE
properties:
allow:
items:
default: DELETE
enum:
- DELETE
type: string
type: array
OAuth2RefreshToken__links_allOf_revoke:
allOf:
- $ref: '#/components/schemas/RevokeRefreshTokenHrefObject'
- properties:
hints:
$ref: '#/components/schemas/OAuth2RefreshToken__links_allOf_revoke_allOf_hints'
description: Link to revoke the refresh Token
example:
hints:
allow:
- DELETE
- DELETE
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
OAuth2RefreshToken__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
app:
allOf:
- $ref: '#/components/schemas/AppResourceHrefObject'
description: Link to the app resource
revoke:
$ref: '#/components/schemas/OAuth2RefreshToken__links_allOf_revoke'
client:
allOf:
- $ref: '#/components/schemas/AppResourceHrefObject'
description: Link to the client resource
user:
allOf:
- $ref: '#/components/schemas/UserResourceHrefObject'
description: Link to the user resource
authorizationServer:
allOf:
- $ref: '#/components/schemas/AuthorizationServerResourceHrefObject'
description: Link to the Token authorization server resource
type: object
example:
app: ""
authorizationServer: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
revoke:
hints:
allow:
- DELETE
- DELETE
href: "https://{yourOktaDomain}/api/v1/users/00u5t60iloOHN9pBi0h7/clients/0oabskvc6442nkvQO0h7/tokens/oar579Mcp7OUsNTlo0g3"
client: ""
user: ""
OAuth2RefreshTokenScope__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the current status of an application using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification. This object is used for dynamic discovery of related resources\
\ and lifecycle operations."
example:
scope: ""
properties:
scope:
allOf:
- $ref: '#/components/schemas/OfflineAccessScopeResourceHrefObject'
description: Link to Scope resource
type: object
OAuth2ScopeConsentGrant__embedded_scope:
example:
id: okta.users.read
properties:
id:
description: The name of the Okta scope for which consent is granted
example: okta.users.read
type: string
type: object
OAuth2ScopeConsentGrant__embedded:
description: Embedded resources related to the Grant
example:
scope:
id: okta.users.read
properties:
scope:
$ref: '#/components/schemas/OAuth2ScopeConsentGrant__embedded_scope'
readOnly: true
type: object
OAuth2ScopeConsentGrant__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
app:
allOf:
- $ref: '#/components/schemas/AppResourceHrefObject'
description: Link to the app resource
client:
allOf:
- $ref: '#/components/schemas/AppResourceHrefObject'
description: Link to the client resource
scope:
allOf:
- $ref: '#/components/schemas/ScopeResourceHrefObject'
description: Link to the scope resource
user:
allOf:
- $ref: '#/components/schemas/UserResourceHrefObject'
description: Link to the user resource
authorizationServer:
allOf:
- $ref: '#/components/schemas/AuthorizationServerResourceHrefObject'
description: Link to the authorization server resource
type: object
- readOnly: true
example:
app: ""
authorizationServer: ""
scope: ""
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
client: ""
user: ""
OSVersion_dynamicVersionRequirement:
description: <div class="x-lifecycle-container"><x-lifecycle class="ea"></x-lifecycle></div>Contains
the necessary properties for a dynamic version requirement
properties:
type:
description: Indicates the type of the dynamic OS version requirement
enum:
- MINIMUM
- EXACT
- EXACT_ANY_SUPPORTED
type: string
x-enumDescriptions:
MINIMUM: The device version must be equal to or newer than the dynamically
determined version. `distanceFromLatestMajor` must be specified for
this type.
EXACT: The device version must be on the same major version as the dynamically
determined version. `distanceFromLatestMajor` must be specified for
this type.
EXACT_ANY_SUPPORTED: The device version must be on a major version which
is supported. You can't specify `distanceFromLatestMajor` for this type.
distanceFromLatestMajor:
description: Indicates the distance from the latest major version
maximum: 1
minimum: 0
type: integer
latestSecurityPatch:
description: Indicates whether the device needs to be on the latest security
patch
type: boolean
type: object
x-okta-lifecycle:
lifecycle: EA
isGenerallyAvailable: false
SKUs: []
OSVersionConstraint_dynamicVersionRequirement:
description: Contains the necessary properties for a dynamic Windows version
requirement
properties:
type:
description: Indicates the type of the dynamic Windows version requirement
enum:
- MINIMUM
- EXACT
- EXACT_ANY_SUPPORTED
- NOT_ALLOWED
type: string
x-enumDescriptions:
MINIMUM: The device version must be equal to or newer than the dynamically
determined Windows version. `distanceFromLatestMajor` must be specified
for this type.
EXACT: The device version must be on the same major version as the dynamically
determined Windows version. `distanceFromLatestMajor` must be specified
for this type.
EXACT_ANY_SUPPORTED: The device version must be on a Windows major version
which is supported. You can't specify `distanceFromLatestMajor` for
this type.
NOT_ALLOWED: The device version isn't allowed. You can't specify `distanceFromLatestMajor`
or `latestSecurityPatch` for this type.
distanceFromLatestMajor:
description: Indicates the distance from the latest Windows major version
maximum: 1
minimum: 0
type: integer
latestSecurityPatch:
description: Indicates whether the policy requires Windows devices to be
on the latest security patch
type: boolean
type: object
OperationResponse_assignmentOperation_configuration_actions_assignUserToRealm:
example:
realmId: realmId
properties:
realmId:
type: string
type: object
OperationResponse_assignmentOperation_configuration_actions:
example:
assignUserToRealm:
realmId: realmId
properties:
assignUserToRealm:
$ref: '#/components/schemas/OperationResponse_assignmentOperation_configuration_actions_assignUserToRealm'
type: object
OperationResponse_assignmentOperation_configuration:
example:
name: name
id: id
conditions:
expression:
value: value
profileSourceId: profileSourceId
actions:
assignUserToRealm:
realmId: realmId
properties:
actions:
$ref: '#/components/schemas/OperationResponse_assignmentOperation_configuration_actions'
conditions:
$ref: '#/components/schemas/Conditions'
id:
type: string
name:
type: string
type: object
OperationResponse_assignmentOperation:
example:
configuration:
name: name
id: id
conditions:
expression:
value: value
profileSourceId: profileSourceId
actions:
assignUserToRealm:
realmId: realmId
properties:
configuration:
$ref: '#/components/schemas/OperationResponse_assignmentOperation_configuration'
type: object
OptInStatusResponse__links:
allOf:
- properties:
optInStatus:
$ref: '#/components/schemas/HrefObject'
OrgCAPTCHASettings__links:
description: Link relations for the CAPTCHA settings object
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
self:
$ref: '#/components/schemas/HrefObject'
readOnly: true
type: object
OrgContactUser__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the Contact Type User object using the [JSON Hypertext Application\
\ Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
example:
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
user:
$ref: '#/components/schemas/HrefObjectUserLink'
readOnly: true
type: object
OrgCreationAdmin_credentials_password:
description: |-
Specifies a password for a user
> **Note:** For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?type=oie&id=ext-configure-password) in the help documentation.
example:
value: pa$$word
properties:
value:
description: Password value (which is validated by the Password Policy)
example: pa$$word
format: password
type: string
writeOnly: true
type: object
OrgCreationAdmin_credentials:
description: Specifies primary authentication and recovery credentials for a
User. Credential types and requirements vary depending on the provider and
security policy of the org.
example:
password:
value: pa$$word
recovery_question:
answer: se7en
question: what is your favourite movie?
properties:
password:
$ref: '#/components/schemas/OrgCreationAdmin_credentials_password'
recovery_question:
$ref: '#/components/schemas/RecoveryQuestionCredential'
type: object
OrgCreationAdmin_profile:
additionalProperties: true
description: |-
Specifies the profile attributes for the first super admin user. The minimal set of required attributes are `email`, `firstName`, `lastName`, and `login`.
See [profile](/openapi/okta-management/management/tag/User/#tag/User/operation/getUser!c=200&path=profile&t=response) for additional profile attributes.
example:
firstName: firstName
lastName: lastName
login: login
email: email
properties:
firstName:
description: Given name of the User (`givenName`)
maxLength: 50
minLength: 1
nullable: true
type: string
lastName:
description: The family name of the User (`familyName`)
maxLength: 50
minLength: 1
nullable: true
type: string
email:
description: "The primary email address of the User. For validation, see\
\ [RFC 5322 Section 3.2.3](https://datatracker.ietf.org/doc/html/rfc5322#section-3.2.3)."
format: email
maxLength: 100
minLength: 5
type: string
login:
description: The unique identifier for the User (`username`)
maxLength: 100
type: string
required:
- email
- firstName
- lastName
- login
type: object
OrgOktaCommunicationSetting__links_optIn:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to opt users in to communication emails
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgOktaCommunicationSetting__links_optOut:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to opt users out of communication emails
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgOktaCommunicationSetting__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
example:
optOut:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
optIn:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
optIn:
$ref: '#/components/schemas/OrgOktaCommunicationSetting__links_optIn'
optOut:
$ref: '#/components/schemas/OrgOktaCommunicationSetting__links_optOut'
readOnly: true
type: object
OrgOktaSupportSettingsObj__links_extend:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to [extend Okta Support Access](/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/extendOktaSupport)"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgOktaSupportSettingsObj__links_revoke:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to [revoke Okta Support Access](/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/revokeOktaSupport)"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgOktaSupportSettingsObj__links_grant:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to [grant Okta Support Access](/openapi/okta-management/management/tag/OrgSettingSupport/#tag/OrgSettingSupport/operation/grantOktaSupport)"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgOktaSupportSettingsObj__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the Okta Support Settings object using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
example:
extend:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
revoke:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
grant:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
extend:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj__links_extend'
revoke:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj__links_revoke'
grant:
$ref: '#/components/schemas/OrgOktaSupportSettingsObj__links_grant'
readOnly: true
type: object
OrgPreferences__links_hideEndUserFooter:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to hide the footer in the End-User Dashboard
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgPreferences__links_showEndUserFooter:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to show the footer on the End-User Dashboard
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
OrgPreferences__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
example:
hideEndUserFooter:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
showEndUserFooter:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
hideEndUserFooter:
$ref: '#/components/schemas/OrgPreferences__links_hideEndUserFooter'
showEndUserFooter:
$ref: '#/components/schemas/OrgPreferences__links_showEndUserFooter'
readOnly: true
type: object
PageRoot__embedded:
example:
preview:
pageContent: pageContent
default:
pageContent: pageContent
customized:
pageContent: pageContent
previewUrl: https://openapi-generator.tech
customizedUrl: https://openapi-generator.tech
properties:
default:
$ref: '#/components/schemas/CustomizablePage'
customized:
$ref: '#/components/schemas/CustomizablePage'
customizedUrl:
format: uri
type: string
preview:
$ref: '#/components/schemas/CustomizablePage'
previewUrl:
format: uri
type: string
readOnly: true
type: object
PageRoot__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
default:
$ref: '#/components/schemas/HrefObject'
customized:
$ref: '#/components/schemas/HrefObject'
preview:
$ref: '#/components/schemas/HrefObject'
example:
preview:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
default:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
customized:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
PasswordImportRequestData_action:
description: This object specifies the default action Okta is set to take. Okta
takes this action if your external service sends an empty HTTP 204 response.
You can override the default action by returning a commands object in your
response specifying the action to take.
properties:
credential:
default: UNVERIFIED
description: "The status of the user credential, either `UNVERIFIED` or\
\ `VERIFIED`"
type: string
type: object
PasswordImportRequestData_context_credential:
properties:
username:
description: The `username` that the user supplied when attempting to sign
in to Okta.
type: string
password:
description: The `password` that the user supplied when attempting to sign
in to Okta.
type: string
type: object
PasswordImportRequestData_context:
properties:
request:
$ref: '#/components/schemas/InlineHookRequestObject'
credential:
$ref: '#/components/schemas/PasswordImportRequestData_context_credential'
type: object
PasswordImportResponse_commands_inner_value:
description: |-
The parameter value of the command.
* To indicate that the supplied credentials are valid, supply a type property set to `com.okta.action.update` together with a value property set to `{"credential": "VERIFIED"}`.
* To indicate that the supplied credentials are invalid, supply a type property set to `com.okta.action.update` together with a value property set to `{"credential": "UNVERIFIED"}`.
Alternatively, you can send an empty response (`204`). By default, the `data.action.credential` is always set to `UNVERIFIED`.
properties:
credential:
enum:
- UNVERIFIED
- VERIFIED
type: string
type: object
PasswordImportResponse_commands_inner:
properties:
type:
description: "The location where you specify the command. For the password\
\ import inline hook, there's only one command, `com.okta.action.update`."
value:
$ref: '#/components/schemas/PasswordImportResponse_commands_inner_value'
type: object
PerClientRateLimitSettings_useCaseModeOverrides:
description: A map of Per-Client Rate Limit Use Case to the applicable PerClientRateLimitMode.
Overrides the `defaultMode` property for the specified use cases.
example:
LOGIN_PAGE: null
OIE_APP_INTENT: null
OAUTH2_AUTHORIZE: null
properties:
LOGIN_PAGE:
$ref: '#/components/schemas/PerClientRateLimitMode'
OAUTH2_AUTHORIZE:
$ref: '#/components/schemas/PerClientRateLimitMode'
OIE_APP_INTENT:
$ref: '#/components/schemas/PerClientRateLimitMode'
type: object
Permission__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
role:
$ref: '#/components/schemas/HrefObject'
example:
role:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
PolicyContext_device:
example:
managed: true
registered: true
platform: platform
assuranceId: assuranceId
properties:
platform:
description: "The platform of the device, for example, IOS."
type: string
registered:
description: If the device is registered
type: boolean
managed:
description: If the device is managed
type: boolean
assuranceId:
description: The device assurance policy ID for the simulation
type: string
type: object
PolicyContext_groups:
description: "An array of Group IDs for the simulate operation. Only user IDs\
\ or Group IDs are allowed, not both."
example:
ids:
- ids
- ids
properties:
ids:
items:
type: string
uniqueItems: true
type: array
required:
- ids
type: object
PolicyContext_risk:
description: The risk rule condition level
example:
level: LOW
properties:
level:
enum:
- LOW
- MEDIUM
- HIGH
type: string
type: object
PolicyContext_user:
description: "The user ID for the simulate operation. Only user IDs or Group\
\ IDs are allowed, not both."
example:
id: id
properties:
id:
description: The unique ID number for the user.
type: string
required:
- id
type: object
PolicyContext_zones:
description: The zone ID under the network rule condition.
example:
ids:
- ids
- ids
properties:
ids:
items:
type: string
type: array
type: object
PolicyMapping__links_allOf_application:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the mapped application
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
PolicyMapping__links_allOf_policy:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the mapped policy
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
PolicyMapping__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
application:
$ref: '#/components/schemas/PolicyMapping__links_allOf_application'
policy:
$ref: '#/components/schemas/PolicyMapping__links_allOf_policy'
example:
application:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
policy:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
PostAuthSessionPolicyRule_allOf_actions_postAuthSession:
description: This object contains a `failureActions` array that defines the
specific action to take when post auth session evaluation detects a failure.
properties:
failureActions:
description: An array of objects that define the action. It can be empty
or contain two `action` value pairs.
items:
$ref: '#/components/schemas/PostAuthSessionFailureActionsObject'
type: array
type: object
PostAuthSessionPolicyRule_allOf_actions:
description: The action to take in response to a failure of the reevaluated
global session policy or authentication polices.
properties:
postAuthSession:
$ref: '#/components/schemas/PostAuthSessionPolicyRule_allOf_actions_postAuthSession'
type: object
PostAuthSessionPolicyRule_allOf_conditions:
properties:
people:
$ref: '#/components/schemas/PolicyPeopleCondition'
type: object
RegistrationInlineHookPPData_allOf_data_context_user:
properties:
passwordChanged:
description: The last time the user's password was updated
format: date-time
type: string
_links:
$ref: '#/components/schemas/BaseContext_user__links'
profile:
additionalProperties: true
description: The user to update's current attributes
type: object
id:
type: string
type: object
RegistrationInlineHookPPData_allOf_data_context:
properties:
request:
$ref: '#/components/schemas/InlineHookRequestObject'
user:
$ref: '#/components/schemas/RegistrationInlineHookPPData_allOf_data_context_user'
type: object
RegistrationInlineHookPPData_allOf_data:
properties:
context:
$ref: '#/components/schemas/RegistrationInlineHookPPData_allOf_data_context'
action:
description: The default action the system takes. Set to `ALLOW`. `DENY`
is never sent to your external service
type: string
userProfileUpdate:
additionalProperties: true
description: Name-value pairs for each new attribute supplied by the user
in the Progressive Profile form
type: object
type: object
RegistrationInlineHookSSRData_allOf_data_context:
properties:
request:
$ref: '#/components/schemas/InlineHookRequestObject'
type: object
RegistrationInlineHookSSRData_allOf_data:
properties:
context:
$ref: '#/components/schemas/RegistrationInlineHookSSRData_allOf_data_context'
action:
description: The default action the system will take. Will be `ALLOW`. `DENY`
will never be sent to your external service.
type: string
userProfile:
additionalProperties: true
description: The name-value pairs for each registration-related attribute
supplied by the user in the Profile Enrollment form.
type: object
type: object
RegistrationResponse_commands_inner:
properties:
type:
description: |-
The location where you specify the command. To set attributes in the user's Okta profile, supply a `type` property set to `com.okta.user.profile.update`, together with a `value` property set to a list of key-value pairs corresponding to the Okta user profile attributes you want to set. The attributes must already exist in your user profile schema.
To explicitly allow or deny registration to the user, supply a type property set to `com.okta.action.update`, together with a value property set to `{"registration": "ALLOW"}` or `{"registration": "DENY"}`. The default is to allow registration.
In Okta Identity Engine, to set attributes in the user's profile, supply a `type` property set to `com.okta.user.progressive.profile.update`, together with a `value` property set to a list of key-value pairs corresponding to the Progressive Enrollment attributes that you want to set. See [Registration inline hook - Send response](https://developer.okta.com/docs/guides/registration-inline-hook/nodejs/main/#send-response).
Commands are applied in the order that they appear in the array. Within a single `com.okta.user.profile.update` or `com.okta.user.progressive.profile.update command`, attributes are updated in the order that they appear in the `value` object.
You can never use a command to update the user's password, but you are allowed to set the values of attributes other than password that are designated sensitive in your Okta user schema. However, the values of those sensitive attributes, if included as fields in the Profile Enrollment form, aren't included in the `data.userProfile` object sent to your external service by Okta. See [data.userProfile](/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/create-registration-hook!path=0/data/userProfile&t=request).
type: string
value:
additionalProperties: true
description: |-
The `value` object is the parameter to pass to the command.
For `com.okta.user.profile.update` commands, `value` should be an object containing one or more name-value pairs for the attributes you wish to update.
For `com.okta.action.update` commands, the value should be an object containing the attribute `action` set to a value of either `ALLOW` or `DENY`, indicating whether the registration should be permitted or not.
Registrations are allowed by default, so setting a value of `ALLOW` for the action field is valid but superfluous.
type: object
type: object
RegistrationResponse_Error_errorCauses_inner:
properties:
errorSummary:
description: Human-readable summary of the error.
type: string
reason:
description: "A brief, enum-like string that indicates the nature of the\
\ error. For example, `UNIQUE_CONSTRAINT` for a property uniqueness violation."
type: string
locationType:
description: "Where in the request the error was found (`body`, `header`,\
\ `url`, or `query`)."
type: string
location:
description: "The valid JSON path to the location of the error. For example,\
\ if there was an error in the user's `login` field, the `location` might\
\ be `data.userProfile.login`."
type: string
domain:
description: "Indicates the source of the error. If the error was in the\
\ user's profile, for example, you might use `end-user`. If the error\
\ occurred in the external service, you might use `external-service`."
type: string
type: object
RegistrationResponse_Error:
description: |-
For the registration inline hook, the `error` object provides a way of displaying an error message to the end user who is trying to register or update their profile.
* If you're using the Okta Sign-In Widget for Profile Enrollment, only the `errorSummary` messages of the `errorCauses` objects that your external service returns appear as inline errors, given the following:
* You don't customize the error handling behavior of the widget.
* The `location` of `errorSummary` in the `errorCauses` object specifies the request object's user profile attribute.
* If you don't return a value for the `errorCauses` object, and deny the user's registration attempt through the `commands` object in your response to Okta, one of the following generic messages appears to the end user:
* "Registration cannot be completed at this time." (SSR)
* "We found some errors. Please review the form and make corrections." (Progressive Enrollment)
* If you don't return an `error` object at all and the registration is denied, the following generic message appears to the end user:
* "Registration denied." (SSR)
* "Profile update denied." (Progressive Enrollment)
>**Note:** If you include an error object in your response, no commands are executed and the registration fails. This holds true even if the top-level `errorSummary` and the `errorCauses` objects are omitted.
properties:
errorSummary:
description: Human-readable summary of one or more errors
type: string
errorCauses:
items:
$ref: '#/components/schemas/RegistrationResponse_Error_errorCauses_inner'
type: array
type: object
ResourceSelectorResponseSchema__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
resources:
$ref: '#/components/schemas/HrefObject'
ResourceSelectorResponseWithoutSelfLinkSchema__links:
allOf:
- properties:
resources:
$ref: '#/components/schemas/HrefObject'
ResourceSet__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
resources:
$ref: '#/components/schemas/HrefObject'
bindings:
$ref: '#/components/schemas/HrefObject'
example:
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resources:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetBindingMembers__links:
allOf:
- $ref: '#/components/schemas/LinksNext'
- properties:
binding:
$ref: '#/components/schemas/HrefObject'
example:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
binding:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetBindingResponse__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
bindings:
$ref: '#/components/schemas/HrefObject'
resource-set:
$ref: '#/components/schemas/HrefObject'
example:
resource-set:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
bindings:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetBindingRole__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
members:
$ref: '#/components/schemas/HrefObject'
example:
members:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetResource__links_self:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: The REST API URL of the related resource
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetResource__links_resource:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to this Resource Set Resource object (self)
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetResource__links_groups:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "If applicable, the REST API URL of the related Groups resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetResource__links_users:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "If applicable, the REST API URL of the related Users resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
ResourceSetResource__links:
description: Related discoverable resources
example:
resource:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
groups:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
self:
$ref: '#/components/schemas/ResourceSetResource__links_self'
resource:
$ref: '#/components/schemas/ResourceSetResource__links_resource'
groups:
$ref: '#/components/schemas/ResourceSetResource__links_groups'
users:
$ref: '#/components/schemas/ResourceSetResource__links_users'
readOnly: true
ResourceSetResources__links:
allOf:
- $ref: '#/components/schemas/LinksNext'
- properties:
resource-set:
$ref: '#/components/schemas/HrefObject'
example:
next:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
resource-set:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
RoleGovernanceResources__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksNext'
RoleGovernanceSource__links:
allOf:
- $ref: '#/components/schemas/LinksGovernanceResources'
- $ref: '#/components/schemas/LinksSelf'
SAMLHookResponse_commands_inner_value_inner_value:
description: |-
The value of the claim that you add or replace, and can also include other attributes. If adding to a claim, add another `value` attribute residing within an array called `attributeValues`.
See the following examples:
#### Simple value (integer or string)
`"value": 300` or `"value": "replacementString"`
#### Attribute value (object)
` "value": {
"authContextClassRef": "replacementValue"
}`
#### AttributeValues array value (object)
` "value": {
"attributes": {
"NameFormat": "urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
},
"attributeValues": [
{"attributes": {
"xsi:type": "xs:string"
},
"value": "4321"}
]
}`
oneOf:
- type: string
- type: integer
- type: object
SAMLHookResponse_commands_inner_value_inner:
properties:
op:
description: |-
The name of one of the supported ops:
`add`: Add a new claim to the assertion
`replace`: Modify any element of the assertion
> **Note:** If a response to the SAML assertion inline hook request isn't received from your external service within three seconds, a timeout occurs. In this scenario, the Okta process flow continues with the original SAML assertion returned.
type: string
path:
description: "Location, within the assertion, to apply the operation"
type: string
value:
$ref: '#/components/schemas/SAMLHookResponse_commands_inner_value_inner_value'
type: object
SAMLHookResponse_commands_inner:
properties:
type:
description: One of the supported commands `com.okta.assertion.patch`
type: string
value:
items:
$ref: '#/components/schemas/SAMLHookResponse_commands_inner_value_inner'
type: array
type: object
SAMLHookResponse_error:
description: |-
An object to return an error. Returning an error causes Okta to record a failure event in the Okta System Log.
The string supplied in the `errorSummary` property is recorded in the System Log event.
> **Note:** If the error object doesn't include the defined `errorSummary` property, the following common default message
is returned to the end user: `The callback service returned an error`.
> **Note:** If a response to a SAML inline hook request isn't received from your external service within three seconds, a timeout occurs. In this scenario, the Okta SAML inline hook process continues, and the user is created.
properties:
errorSummary:
description: A human-readable summary of the error
type: string
type: object
SAMLPayLoad_data_context_allOf_protocol_issuer:
properties:
id:
description: The unique identifier of the issuer that provided the SAML
assertion
example: 0oath92zlO60urQOP0g3
type: string
name:
description: The name of the issuer that provided the SAML assertion
example: SAML 2.0 App
type: string
uri:
description: The base URI of the SAML endpoint that's used to assert the
authorization
example: http://www.okta.com/exkth8lMzFm0HZOTU0g3
type: string
type: object
SAMLPayLoad_data_context_allOf_protocol:
description: Details of the assertion protocol being used
properties:
type:
description: The type of authentication protocol being used for the assertion
example: SAML2.0
type: string
issuer:
$ref: '#/components/schemas/SAMLPayLoad_data_context_allOf_protocol_issuer'
type: object
SAMLPayLoad_data_context:
allOf:
- $ref: '#/components/schemas/BaseContext'
- properties:
protocol:
$ref: '#/components/schemas/SAMLPayLoad_data_context_allOf_protocol'
type: object
SAMLPayLoad_data_assertion_subject_confirmation_data:
properties:
recipient:
description: The token endpoint URL of the authorization server
example: http://www.example.com:7070/saml/sso
type: string
type: object
SAMLPayLoad_data_assertion_subject_confirmation:
properties:
method:
description: Used to indicate how the authorization server confirmed the
SAML assertion
example: urn:oasis:names:tc:SAML:2.0:cm:bearer
type: string
data:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_subject_confirmation_data'
type: object
SAMLPayLoad_data_assertion_subject:
description: Provides a JSON representation of the `<saml:Subject>` element
of the SAML assertion
properties:
nameId:
description: The unique identifier of the user
example: user@example.com
type: string
nameFormat:
description: Indicates how to interpret the attribute name
example: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
type: string
confirmation:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_subject_confirmation'
type: object
SAMLPayLoad_data_assertion_authentication_authnContext:
description: Details of the authentication methods used for the SAML assertion
properties:
authnContextClassRef:
description: Describes the identity provider's supported authentication
context classes
example: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
type: string
type: object
SAMLPayLoad_data_assertion_authentication:
description: Provides a JSON representation of the `<saml:AuthnStatement>` element
of the SAML assertion
properties:
sessionIndex:
description: The unique identifier describing the assertion statement
example: id1553800523546.312669168
type: string
authnContext:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_authentication_authnContext'
type: object
SAMLPayLoad_data_assertion_conditions:
description: Provides a JSON representation of the `<saml:Conditions>` element
of the SAML assertion
properties:
audienceRestriction:
description: Describes which service providers the assertion is valid for
items:
example: "[\"urn:example:sp\"]"
type: string
type: array
type: object
SAMLPayLoad_data_assertion_claims_value_attributes:
properties:
NameFormat:
description: Indicates how to interpret the attribute name
type: string
type: object
SAMLPayLoad_data_assertion_claims_value_attributeValues_inner_attributes:
properties:
xsi:type:
description: Used to derive the type of the attribute
type: string
type: object
SAMLPayLoad_data_assertion_claims_value_attributeValues_inner:
properties:
attributes:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_claims_value_attributeValues_inner_attributes'
value:
description: The actual value of the attribute
type: string
type: object
SAMLPayLoad_data_assertion_claims_value:
properties:
attributes:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_claims_value_attributes'
attributeValues:
items:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_claims_value_attributeValues_inner'
type: array
type: object
SAMLPayLoad_data_assertion_lifetime:
description: "Specifies the expiration time, in seconds, of the SAML assertion"
properties:
expiration:
description: The expiration time in seconds
example: 300
type: integer
type: object
SAMLPayLoad_data_assertion:
description: Details of the SAML assertion that was generated
properties:
subject:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_subject'
authentication:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_authentication'
conditions:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_conditions'
claims:
additionalProperties:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_claims_value'
description: Provides a JSON representation of the `<saml:AttributeStatement>`
element contained in the generated SAML assertion. Contains any optional
SAML attribute statements that you have defined for the app using the
Admin Console's **SAML Settings**.
type: object
lifetime:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion_lifetime'
type: object
SAMLPayLoad_data:
properties:
context:
$ref: '#/components/schemas/SAMLPayLoad_data_context'
assertion:
$ref: '#/components/schemas/SAMLPayLoad_data_assertion'
type: object
Saml_acs_inner:
properties:
index:
description: Index of ACS URL. You can't reuse the same index in the ACS
URL array.
example: 0
maximum: 65535
minimum: 0
type: number
url:
description: Assertion Consumer Service (ACS) URL
example: "https://${org.subdomain}.example.com/saml/login"
format: uri
maxLength: 1024
type: string
type: object
Saml_claims_inner:
properties:
name:
description: The attribute name
example: Address
type: string
values:
description: The Okta values inserted in the attribute statement
items:
example: "${user.homeAddress}"
type: string
type: array
type: object
SecurityEventsProviderRequest_settings:
description: Information about the Security Events Provider for signal ingestion
oneOf:
- $ref: '#/components/schemas/SecurityEventsProviderSettingsSSFCompliant'
- $ref: '#/components/schemas/SecurityEventsProviderSettingsNonSSFCompliant'
type: object
SignInPage_allOf_widgetCustomizations:
example:
usernameInfoTip: usernameInfoTip
showUserIdentifier: true
customLink1Url: customLink1Url
customLink2Url: customLink2Url
classicRecoveryFlowEmailOrUsernameLabel: classicRecoveryFlowEmailOrUsernameLabel
customLink1Label: customLink1Label
passwordInfoTip: passwordInfoTip
forgotPasswordLabel: forgotPasswordLabel
showPasswordVisibilityToggle: true
authenticatorPageCustomLinkLabel: authenticatorPageCustomLinkLabel
unlockAccountLabel: unlockAccountLabel
helpUrl: helpUrl
unlockAccountUrl: unlockAccountUrl
usernameLabel: usernameLabel
signInLabel: signInLabel
customLink2Label: customLink2Label
authenticatorPageCustomLinkUrl: authenticatorPageCustomLinkUrl
passwordLabel: passwordLabel
forgotPasswordUrl: forgotPasswordUrl
helpLabel: helpLabel
widgetGeneration: G2
properties:
signInLabel:
description: The label for the sign in widget
type: string
usernameLabel:
description: The label for the username field
type: string
usernameInfoTip:
description: The label for the username information tip
type: string
passwordLabel:
description: The label for the password field
type: string
passwordInfoTip:
description: The label for the password information tip
type: string
showPasswordVisibilityToggle:
description: Allows users to see their passwords as they type
type: boolean
showUserIdentifier:
description: Allows the user's identifier to appear on authentication and
enrollment pages
type: boolean
forgotPasswordLabel:
description: The label for the forgot password page
type: string
forgotPasswordUrl:
description: The forgot password URL
type: string
unlockAccountLabel:
description: The label for the unlock account link
type: string
unlockAccountUrl:
description: The unlock account URL
type: string
helpLabel:
description: The label for the help link
type: string
helpUrl:
description: The help link URL
type: string
customLink1Label:
description: The label for the first custom link
type: string
customLink1Url:
description: The URL for the first custom link
type: string
customLink2Label:
description: The label for the second custom link
type: string
customLink2Url:
description: The URL for the second custom link
type: string
authenticatorPageCustomLinkLabel:
description: The label for the authenticator page custom link
type: string
authenticatorPageCustomLinkUrl:
description: The URL for the authenticator page custom link
type: string
classicRecoveryFlowEmailOrUsernameLabel:
description: The label for the username field in the classic recovery flow
type: string
widgetGeneration:
$ref: '#/components/schemas/WidgetGeneration'
type: object
SimulatePolicyEvaluations_evaluated:
description: A list of evaluated but not matched policies and rules
example:
policies:
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
properties:
policies:
items:
$ref: '#/components/schemas/SimulateResultPoliciesItems'
type: array
type: object
SimulatePolicyEvaluations_undefined:
description: A list of undefined but not matched policies and rules
example:
policies:
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
rules:
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
- name: name
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
id: id
conditions:
- type: type
status: MATCH
- type: type
status: MATCH
status: null
properties:
policies:
items:
$ref: '#/components/schemas/SimulateResultPoliciesItems'
type: array
type: object
SourceLinks_allOf_schema:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: The associated schema
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
StandardRole__embedded_targets_catalog:
description: App targets
example:
apps:
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
properties:
apps:
items:
$ref: '#/components/schemas/CatalogApplication'
type: array
StandardRole__embedded_targets:
description: Targets configured for the Role Assignment
example:
catalog:
apps:
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
groups:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
- lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
properties:
groups:
description: Group targets
items:
$ref: '#/components/schemas/Group'
type: array
catalog:
$ref: '#/components/schemas/StandardRole__embedded_targets_catalog'
type: object
StandardRole__embedded:
description: Optional embedded resources for the Role Assignment
example:
targets:
catalog:
apps:
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
- features:
- features
- features
lastUpdated: 2000-01-23T04:56:07.000+00:00
website: website
verificationStatus: verificationStatus
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
displayName: displayName
name: name
description: description
id: id
category: category
signOnModes:
- signOnModes
- signOnModes
status: ACTIVE
groups:
- lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
- lastUpdated: 2000-01-23T04:56:07.000+00:00
lastMembershipUpdated: 2000-01-23T04:56:07.000+00:00
_embedded:
key: "{}"
_links:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
logo:
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
- templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
source:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
users:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
apps:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
created: 2000-01-23T04:56:07.000+00:00
profile:
name: West Coast Users
description: All Users West of The Rockies
objectClass:
- objectClass
- objectClass
id: 0gabcd1234
type: APP_GROUP
properties:
targets:
$ref: '#/components/schemas/StandardRole__embedded_targets'
type: object
StreamConfiguration_aud:
description: |-
The audience used in the SET. This value is set as `aud` in the claim.
A read-only parameter that is set by the transmitter. If this parameter is included in the request, the value must match the expected value from the transmitter.
example: https://example.com
oneOf:
- example: https://example.com
format: uri
type: string
- items:
example: https://example.com
format: uri
type: string
type: array
SubmissionResponse_config_inner:
properties:
label:
description: Display name of the variable in the Admin Console
example: Subdomain
type: string
name:
description: Name of the variable
example: subdomain
maxLength: 1024
minLength: 1
type: string
type: object
Subscription__links:
description: Discoverable resources related to the subscription
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
self:
$ref: '#/components/schemas/HrefObject'
readOnly: true
type: object
SupportedMethods_settings:
example:
algorithms:
- ES256
- ES256
transactionTypes:
- CIBA
- CIBA
keyProtection: ANY
properties:
keyProtection:
$ref: '#/components/schemas/PushMethodKeyProtection'
algorithms:
description: The encryption algorithm for this authenticator method
items:
$ref: '#/components/schemas/AuthenticatorMethodAlgorithm'
type: array
transactionTypes:
description: The transaction type for this authenticator method
items:
$ref: '#/components/schemas/AuthenticatorMethodTransactionType'
type: array
type: object
TelephonyRequestData_messageProfile:
description: Message profile specifies information about the telephony (sms/voice)
message to be sent to the Okta user
properties:
msgTemplate:
description: Default or Okta org configured sms or voice message template
type: string
phoneNumber:
description: The Okta's user's phone number
type: string
otpExpires:
description: The time when OTP expires
type: string
deliveryChannel:
description: The channel for OTP delivery - SMS or voice
type: string
otpCode:
description: The OTP code requested by the Okta user
type: string
locale:
description: The locale associated with the Okta user
type: string
type: object
TelephonyRequestData_userProfile:
description: User profile specifies information about the Okta user
properties:
firstName:
description: The user's first name
type: string
lastName:
description: The user's last name
type: string
login:
description: The user's Okta login
type: string
userId:
description: The user's Okta user ID
type: string
type: object
TelephonyResponse_commands_inner_value_inner:
properties:
status:
description: Status of telephony callout
enum:
- SUCCESSFUL
- PENDING
- FAILED
type: string
x-enumDescriptions:
SUCCESSFUL: External web service was able to deliver the OTP to the Requester.
PENDING: External web service wasn't able to confirm delivery of the OTP
to the Requester.
FAILED: External web service was unable to deliver the OTP to the Requester.
provider:
description: Telephony provider for sms/voice
type: string
transactionId:
description: Transaction ID for sms/voice
type: string
transactionMetadata:
description: Any relevant metadata for the telephony transaction
type: string
type: object
TelephonyResponse_commands_inner:
properties:
type:
description: "The location where you specify the command. For the Telephony\
\ inline hook, there's only one command, `com.okta.telephony.action`."
type: string
value:
description: "The status of the telephony operation along with optional\
\ additional information about the provider, transaction ID and any other\
\ transaction metadata."
items:
$ref: '#/components/schemas/TelephonyResponse_commands_inner_value_inner'
type: array
type: object
TestInfo_oidcTestConfiguration:
description: OIDC test details
properties:
idp:
description: "Read only.<br>Indicates if your integration supports IdP-initiated\
\ sign-in flows. If [`sso.oidc.initiateLoginUri`](/openapi/okta-management/management/tag/YourOinIntegrations/#tag/YourOinIntegrations/operation/createSubmission!path=sso/oidc/initiateLoginUri&t=request)\
\ is specified, this property is set to `true`. If [`sso.oidc.initiateLoginUri`](/openapi/okta-management/management/tag/YourOinIntegrations/#tag/YourOinIntegrations/operation/createSubmission!path=sso/oidc/initiateLoginUri&t=request)\
\ isn't set for the integration submission, this property is set to `false`"
readOnly: true
type: boolean
sp:
description: Read only.<br>Indicates if your integration supports SP-initiated
sign-in flows and is always set to `true` for OIDC SSO
readOnly: true
type: boolean
jit:
description: Indicates if your integration supports Just-In-Time (JIT) provisioning
type: boolean
spInitiateUrl:
description: URL for SP-initiated sign-in flows (required if `sp = true`)
example: https://test.example.com/strawberry/oidc/sp-init
format: uri
maxLength: 512
type: string
required:
- spInitiateUrl
type: object
TestInfo_samlTestConfiguration:
description: SAML test details
properties:
idp:
description: Indicates if your integration supports IdP-initiated sign-in
type: boolean
sp:
description: Indicates if your integration supports SP-initiated sign-in
type: boolean
jit:
description: Indicates if your integration supports Just-In-Time (JIT) provisioning
type: boolean
spInitiateUrl:
description: URL for SP-initiated sign-in flows (required if `sp = true`)
example: https://test.example.com/strawberry/saml/sp-init
format: uri
maxLength: 512
type: string
spInitiateDescription:
description: Instructions on how to sign in to your app using the SP-initiated
flow (required if `sp = true`)
example: Go to your app URL from a browser and enter your username
maxLength: 2048
type: string
required:
- spInitiateUrl
type: object
TestInfo_testAccount:
description: "An account on a test instance of your app with admin privileges.\
\ A test admin account is required by Okta for integration testing. During\
\ OIN QA testing, an Okta analyst uses this admin account to configure your\
\ app for the various test case flows."
properties:
url:
description: The sign-in URL to a test instance of your app
example: https://example.com/strawberry/login
format: uri
maxLength: 512
type: string
username:
description: The username for your app admin account
example: test@example.com
maxLength: 255
type: string
password:
description: The password for your app admin account
example: sUperP@ssw0rd
maxLength: 255
type: string
instructions:
description: "Additional instructions to test the app integration, including\
\ instructions for obtaining test accounts"
example: Go to your app URL from a browser and enter your credentials
maxLength: 2048
type: string
required:
- password
- url
- username
type: object
TokenHookResponse_commands_inner_value_inner_value:
description: Value to set the claim to.
oneOf:
- type: string
- type: integer
- type: object
TokenHookResponse_commands_inner_value_inner:
properties:
op:
description: "The name of one of the supported ops: `add`: Add a claim.\
\ `replace`: Modify an existing claim and update the token lifetime. `remove`:\
\ Remove an existing claim.\n#### `op: add` notes\n\n<details>\n<summary>Add\
\ a claim</summary>\n \n Add a claim\n\n **Existing JSON**\n \n ```\n\
\ {\n \"employeeId\": \"00u12345678\"\n }\n ```\n\n **Operation**\n\
\n ```\n {\n \"commands\": [\n {\n \"type\": \"com.okta.assertion.patch\"\
,\n \"value\": [\n {\n \"op\": \"add\",\n \
\ \"path\": \"/claims/extPatientId\",\n \"value\"\
: \"1234\"\n }\n ]\n },\n {\n \"type\"\
: \"com.okta.assertion.patch\",\n \"value\": [\n {\n \
\ \"op\": \"add\",\n \"path\": \"/claims/external_guid\"\
,\n \"value\": \"F0384685-F87D-474B-848D-2058AC5655A7\"\n \
\ }\n ]\n }\n ]\n }\n ```\n \n **Updated JSON**\n\
\ \n ```\n {\n \"employeeId\": \"00u12345678\",\n \"extPatientId\"\
: 1234,\n \"external_guid\": \"F0384685-F87D-474B-848D-2058AC5655A7\"\
\n }\n ```\n\n > **Note:** If you use the `add` operation and include\
\ an existing claim in your response with a different value, that value\
\ is replaced. Use the `replace` operation instead. If you attempt to\
\ remove a system-specific claim or use an invalid operation, the entire\
\ PATCH fails and errors are logged in the token hooks events. See `op:\
\ replace` notes.\n</details>\n\n<details>\n<summary>Add new members to\
\ existing JSON objects</summary>\n \n If you have a JSON object in\
\ a claim called `employee_profile`, and you want to add the `department_id`\
\ member to the claim, the existing JSON is updated by specifying the\
\ claim in the path, followed by the name of the object member.\n\n **Existing\
\ JSON**\n \n ```\n {\n \"employee_profile\": {\n \"employee_id\"\
: \"1234\",\n \"name\": \"Anna\"\n }\n }\n ```\n\n **Operation**\n\
\n ```\n {\n \"commands\": [\n {\n \"type\": \"com.okta.identity.patch\"\
,\n \"value\": [\n {\n \"op\": \"add\",\n \
\ \"path\": \"/claims/employee_profile/department_id\",\n \
\ \"value\": \"4947\"\n }\n ]\n }\n ]\n\
\ }\n ```\n \n **Updated JSON**\n \n ```\n {\n \"employee_profile\"\
: {\n \"employee_id\": \"1234\",\n \"name\": \"Anna\",\n \
\ \"department_id\": \"4947\"\n }\n }\n ```\n\n > **Note:** If\
\ you attempt to add a member within a JSON object that doesn't exist\
\ or using an invalid operation, the entire PATCH fails and errors are\
\ logged in the token hooks events.\n</details>\n\n<details>\n<summary>Add\
\ new elements to existing arrays</summary>\n \n Append an element to\
\ an array by specifying the name of the array, followed by the index\
\ where you want to insert the element in the path. Alternatively, you\
\ can specify the array name followed by a hyphen (-) in the path to append\
\ an element at the end of the array. For example, you have an array that\
\ contains the user's preferred airports, and you want to add a new airport\
\ to the array. The existing target JSON object is updated by specifying\
\ the claim in the path, followed by the index of where to insert the\
\ claim.\n \n **Existing JSON**\n \n ```\n {\n \"preferred_airports\"\
:[\n \"sjc\",\n \"sfo\",\n \"oak\"\n ]\n }\n ```\n\
\n **Operation**\n\n ```\n {\n \"commands\": [\n {\n \
\ \"type\": \"com.okta.identity.patch\",\n \"value\": [\n \
\ {\n \"op\": \"add\",\n \"path\": \"/claims/preferred_airports/3\"\
,\n \"value\": \"lax\"\n }\n ]\n }\n \
\ ]\n }\n ```\n\n **Updated JSON**\n \n ```\n {\n \"preferred_airports\"\
:[\n \"sjc\",\n \"sfo\",\n \"oak\",\n \"lax\"\n \
\ ]\n }\n ```\n \n > **Note:** If you attempt to add an element within\
\ an array that doesn't exist or specify an invalid index, the entire\
\ PATCH fails and errors are logged in the token hooks events.\n</details>\n\
\n#### `op: replace` notes\n\n<details>\n<summary>Modify an existing claim</summary>\n\
\n You can modify (`replace`) existing custom claims or OIDC standard\
\ profile claims, such as `birthdate` and `locale`. You can't, however,\
\ modify any system-specific claims, such as `iss` or `ver`. Also, you\
\ can't modify a claim that isn't currently part of the token in the request\
\ payload. Attempting to modify a system-specific claim or using an invalid\
\ operation results in the entire PATCH failing and errors logged in the\
\ token hooks events.\n \n See [Access Tokens Scopes and Claims](/openapi/okta-oauth/guides/overview/#access-token-scopes-and-claims)\
\ for the list of access token-reserved claims that you can't modify.\n\
\n > **Note:** Although the `aud` and `sub` claims are listed as reserved\
\ claims, you can modify those claims in access tokens. You can't modify\
\ these claims in ID tokens.\n\n See [ID Token Claims](/openapi/okta-oauth/guides/overview/#id-token-claims)\
\ for a list of ID token-reserved claims that you can't modify.\n\n **Existing\
\ target JSON object**\n\n ```\n {\n \"employeeId\": \"00u12345678\"\
,\n \"extPatientId\": 1234,\n \"external_guid\": \"F0384685-F87D-474B-848D-2058AC5655A7\"\
\n }\n ```\n\n **Operation**\n\n ```\n {\n \"commands\": [\n \
\ {\n \"type\": \"com.okta.identity.patch\",\n \"value\"\
: [\n {\n \"op\": \"replace\",\n \"path\"\
: \"/claims/extPatientId\",\n \"value\": \"12345\"\n \
\ },\n {\n \"op\": \"replace\",\n \"\
path\": \"/claims/external_guid\",\n \"value\": \"D1495796-G98E-585C-959E-1269CD6766B8\"\
\n }\n ]\n }\n ]\n }\n ```\n\n **Updated JSON***\n\
\n ```\n {\n \"employeeId\": \"00u12345678\",\n \"extPatientId\"\
: 12345,\n \"external_guid\": \"D1495796-G98E-585C-959E-1269CD6766B8\"\
\n }\n ```\n \n</details>\n\n<details>\n<summary>Modify members within\
\ existing JSON objects and arrays</summary>\n \n Use the `replace`\
\ operation to modify members within JSON objects and elements within\
\ arrays. For example, you have a JSON object in a claim called `employee_profile`,\
\ and you want to update the email address of the employee. The existing\
\ target JSON object is updated by specifying the claim in the path, followed\
\ by the name of the object member that you want to modify.\n\n **Existing\
\ target JSON object**\n \n ```\n {\n \"employee_profile\": {\n\
\ \"employee_id\":\"1234\",\n \"name\":\"Anna\",\n \"email\"\
:\"anna.v@company.com\"\n }\n }\n ```\n\n **Operation**\n\n ```\n\
\ {\n \"commands\": [\n {\n \"type\": \"com.okta.identity.patch\"\
,\n \"value\": [\n {\n \"op\": \"replace\"\
,\n \"path\": \"/claims/employee_profile/email\",\n \
\ \"value\": \"anna@company.com\"\n }\n ]\n }\n\
\ ]\n }\n ```\n\n **Updated JSON**\n \n ```\n {\n \"employee_profile\"\
: {\n \"employee_id\":\"1234\",\n \"name\":\"Anna\",\n \
\ \"email\":\"anna@company.com\"\n }\n }\n ```\n\n > **Note:**\
\ If you attempt to modify a member within a JSON object that doesn't\
\ exist or use an invalid operation, the entire PATCH fails and errors\
\ are logged in the token hooks events.\n \n Similarly, you can replace\
\ elements in an array by specifying the array name and the valid index\
\ of the element that you want to replace in the path.\n</details>\n\n\
<details>\n<summary>Modify token lifetimes</summary>\n You can modify\
\ how long the access and ID tokens are valid by specifying the `lifetime`\
\ in seconds. The `lifetime` value must be a minimum of five minutes (300\
\ seconds) and a maximum of 24 hours (86,400 seconds).\n\n **Operation**\n\
\n ```\n {\n \"commands\": [\n {\n \"type\": \"com.okta.identity.patch\"\
,\n \"value\": [\n {\n \"op\": \"replace\"\
,\n \"path\": \"/token/lifetime/expiration\",\n \
\ \"value\": 36000\n }\n ]\n },\n {\n \
\ \"type\": \"com.okta.access.patch\",\n \"value\": [\n \
\ {\n \"op\": \"replace\",\n \"path\": \"/token/lifetime/expiration\"\
,\n \"value\": 36000\n }\n ]\n }\n \
\ ]\n }\n ```\n\n</details>\n\n#### `op: remove` notes\n\n<details>\n\
<summary>Remove a claim</summary>\n\n You can remove existing custom\
\ claims or OIDC standard profile claims, such as `birthdate` or `locale`.\
\ You can't, however, remove any system-specific claims, such as `iss`\
\ or `ver`. You also can't remove a claim that isn't currently part of\
\ the token in the request payload. If you attempt to remove a system-specific\
\ claim or use an invalid operation, the entire PATCH fails and errors\
\ are logged in the token hooks events.\n\n See [Access Tokens Scopes\
\ and Claims](/openapi/okta-oauth/guides/overview/#access-token-scopes-and-claims)\
\ for the list of access token-reserved claims that you can't modify.\n\
\n See [ID Token Claims](/openapi/okta-oauth/guides/overview/#id-token-claims)\
\ for a list of ID token-reserved claims that you can't modify.\n\n **Operation**\n\
\n ```\n {\n \"commands\": [\n {\n \"type\": \"com.okta.identity.patch\"\
,\n \"value\": [\n {\n \"op\": \"remove\",\n\
\ \"path\": \"/claims/birthdate\",\n \"value\":\
\ null\n }\n ]\n },\n {\n \"type\": \"\
com.okta.access.patch\",\n \"value\": [\n {\n \
\ \"op\": \"remove\",\n \"path\": \"/claims/external_guid\"\
\n }\n ]\n }\n ]\n }\n ```\n\n > **Note:**\
\ The `value` property for the `remove` operation isn't required. If you\
\ provide it in the response, it should be set to `null`. Providing any\
\ other value fails the entire PATCH response.\n\n</details>\n\n<details>\n\
<summary>Remove members from existing arrays</summary>\n\n Use the `remove`\
\ operation to remove members from existing arrays. For example, you have\
\ an array that contains the user's preferred airports, and you want to\
\ remove an airport from the array. The existing target JSON object is\
\ updated by specifying the array name followed by the index of the element\
\ that you want to remove. You don't need to specify a value for the remove\
\ operation, but you can specify `null` as the value if you want.\n \n\
\ **Existing target JSON object**\n \n ```\n {\n \"preferred_airports\"\
: [\n \"sjc\",\n \"lax\",\n \"sfo\",\n \"\
oak\"\n ]\n }\n ```\n \n **Operation**\n\n ```\n {\n \"\
commands\": [\n {\n \"type\": \"com.okta.identity.patch\"\
,\n \"value\": [\n {\n \"op\": \"remove\",\n\
\ \"path\": \"/claims/preferred_airports/1\"\n }\n\
\ ]\n }\n ]\n }\n ```\n\n **Updated JSON**\n \n ```\n\
\ {\n \"preferred_airports\": [\n \"sjc\",\n \"sfo\"\
,\n \"oak\"\n ]\n }\n ```\n\n</details>\n\n<details>\n<summary>Remove\
\ members from existing JSON objects</summary>\n\n Use the `remove` operation\
\ to remove members from existing JSON objects. Do this by specifying\
\ the JSON object in the path, followed by the claim member that you would\
\ like to remove. For example, you have an `employee_profile` claim, and\
\ you want to remove `email` from it.\n\n**Existing target JSON object**\n\
\n```\n{\n \"employee_profile\": {\n \"employee_id\":\"1234\",\n \
\ \"name\":\"Anna\",\n \"email\":\"anna.v@company.com\"\n }\n\
}\n```\n\n**Operation**\n\n```\n{\n \"commands\": [\n {\n \"\
type\": \"com.okta.identity.patch\",\n \"value\": [\n {\n\
\ \"op\": \"remove\",\n \"path\": \"/claims/employee_profile/email\"\
\n }\n ]\n }\n ]\n}\n```\n\n**Updated JSON**\n```\n{\n\
\ \"employee_profile\": {\n \"employee_id\":\"1234\",\n \"name\"\
:\"Anna\",\n }\n}\n```\n\n</details>"
type: string
path:
description: "Location within the token to apply the operation, specified\
\ as a slash-delimited path. When you add, replace, or remove a claim,\
\ this path always begins with `/claims/` and is followed by the name\
\ of the new claim that you're adding. When you replace a token lifetime,\
\ the path should always be `/token/lifetime/expiration`."
type: string
value:
$ref: '#/components/schemas/TokenHookResponse_commands_inner_value_inner_value'
type: object
TokenHookResponse_commands_inner:
properties:
type:
description: |-
One of the supported commands:
`com.okta.identity.patch`: Modify an ID token
`com.okta.access.patch`: Modify an access token
> **Note:** The `commands` array should only contain commands that can be applied to the requested tokens. For example, if only an ID token is requested, the `commands` array shouldn't contain commands of the type `com.okta.access.patch`.
type: string
value:
description: "The `value` object is where you specify the operation to perform.\
\ It's an array, which allows you to request more than one operation."
items:
$ref: '#/components/schemas/TokenHookResponse_commands_inner_value_inner'
type: array
type: object
TokenHookResponse_error:
description: "When an error object is returned, it causes Okta to return an\
\ OAuth 2.0 error to the requester of the token. In the error response, the\
\ value of `error` is `server_error`, and the value of `error_description`\
\ is the string that you supplied in the `errorSummary` property of the `error`\
\ object that you returned."
properties:
errorSummary:
description: "Human-readable summary of the error. If the error object doesn't\
\ include the `errorSummary` property defined, the following common default\
\ message is returned to the end user: `The callback service returned\
\ an error`."
type: string
type: object
TokenPayLoad_data_context_allOf_protocol_OriginalGrant:
description: "Information about the original token request used to get the refresh\
\ token being used, when in a refresh token request"
properties:
request:
$ref: '#/components/schemas/TokenProtocolRequest'
refresh_token:
$ref: '#/components/schemas/RefreshToken'
type: object
TokenPayLoad_data_context_allOf_protocol_issuer:
description: The authorization server's issuer identifier
properties:
uri:
description: The authorization server's issuer identifier
format: uri
type: string
type: object
TokenPayLoad_data_context_allOf_protocol_client:
description: The client making the token request
properties:
id:
description: The unique identifier of the client
type: string
name:
description: The name of the client
type: string
type:
description: The type of client
example: PUBLIC
type: string
type: object
TokenPayLoad_data_context_allOf_protocol:
description: Details of the authentication protocol
properties:
type:
description: The type of authentication protocol used
example: OAUTH2.0
type: string
request:
$ref: '#/components/schemas/TokenProtocolRequest'
OriginalGrant:
$ref: '#/components/schemas/TokenPayLoad_data_context_allOf_protocol_OriginalGrant'
issuer:
$ref: '#/components/schemas/TokenPayLoad_data_context_allOf_protocol_issuer'
client:
$ref: '#/components/schemas/TokenPayLoad_data_context_allOf_protocol_client'
type: object
TokenPayLoad_data_context_allOf_policy_rule:
description: The authorization server policy rule used to mint the token
properties:
id:
description: The unique identifier for the policy rule
example: 0pr4ktb7elD3ZvrMy0g7
type: string
type: object
TokenPayLoad_data_context_allOf_policy:
description: The authorization server policy used to mint the token
properties:
id:
description: The unique identifier for the policy
example: 00p4ktaq2ryOYtsHC0g7
type: string
rule:
$ref: '#/components/schemas/TokenPayLoad_data_context_allOf_policy_rule'
type: object
TokenPayLoad_data_context:
allOf:
- $ref: '#/components/schemas/BaseContext'
- properties:
protocol:
$ref: '#/components/schemas/TokenPayLoad_data_context_allOf_protocol'
policy:
$ref: '#/components/schemas/TokenPayLoad_data_context_allOf_policy'
type: object
TokenPayLoad_data_identity:
allOf:
- description: "Provides information on the properties of the ID token that\
\ Okta has generated, including the existing claims that it contains"
- $ref: '#/components/schemas/BaseToken'
TokenPayLoad_data_access:
allOf:
- description: "Provides information on the properties of the access token that\
\ Okta has generated, including the existing claims that it contains"
- $ref: '#/components/schemas/BaseToken'
- properties:
scopes:
description: "The scopes contained in the token. For descriptions of the\
\ scopes that you can include, see the Okta [OpenID Connect and OAuth\
\ 2.0 API reference](/openapi/okta-oauth/guides/overview/#scopes)."
type: object
type: object
TokenPayLoad_data:
properties:
context:
$ref: '#/components/schemas/TokenPayLoad_data_context'
identity:
$ref: '#/components/schemas/TokenPayLoad_data_identity'
access:
$ref: '#/components/schemas/TokenPayLoad_data_access'
refresh_token:
$ref: '#/components/schemas/RefreshToken'
type: object
UIElement_options:
description: UI Schema element options object
example:
format: text
properties:
format:
description: Specifies how the input appears
enum:
- text
- radio
- select
- checkbox
- radio_yes_no
- radio_true_false
type: string
x-enumDescriptions:
text: The default format for the majority of property types
radio: Radio button options. This option is only available for `string`
data types with an `enum` or `one of` constraint.
select: Displays input as a dropdown list. This option is only available
for the `country-code` data type or a string data type with an enum
or one of constraint.
checkbox: Displays input as a checkbox. This option is only available
for Boolean data types.
radio_yes_no: "Displays input as two radio buttons, one with the option\
\ `yes` and the other `no`. This option is only available for Boolean\
\ data types."
radio_true_false: "Displays input as two radio buttons, one with the option\
\ `true` and the other `false`. This option is only available for Boolean\
\ data types."
type: object
User__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- properties:
self:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to the individual user
activate:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to activate the user
resetPassword:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to reset the User's password
resetFactors:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to reset the User's factors
expirePassword:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to expire the User's password
forgotPassword:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to initiate a forgot password operation
changeRecoveryQuestion:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to change the User's recovery question
deactivate:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to deactivate a user
reactivate:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to reactivate the user
changePassword:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to change the User's password
schema:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to the User's profile schema
suspend:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to suspend the user
unsuspend:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to unsuspend the user
unlock:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to unlock the locked-out user
type:
allOf:
- $ref: '#/components/schemas/HrefObject'
description: URL to the User Type
type: object
- readOnly: true
description: |-
Specifies link relations (see [Web Linking](https://datatracker.ietf.org/doc/html/rfc8288) available for the current status of a user.
The Links object is used for dynamic discovery of related resources, lifecycle operations, and credential operations. The Links object is read-only.
For an individual User result, the Links object contains a full set of link relations available for that User as determined by your policies.
For a collection of users, the Links object contains only the `self` link. Operations that return a collection of Users include List Users and List Group Members.
example:
schema: ""
suspend: ""
resetPassword: ""
unlock: ""
reactivate: ""
unsuspend: ""
resetFactors: ""
type: ""
deactivate: ""
changePassword: ""
forgotPassword: ""
expirePassword: ""
changeRecoveryQuestion: ""
activate: ""
self: ""
UserFactorActivateResponse__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksUser'
- $ref: '#/components/schemas/LinksVerify'
example:
self:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
verify:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
user:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
UserFactorPushTransactionRejected_allOf_profile:
properties:
credentialId:
description: ID for the Factor credential
example: dade.murphy@example.com
type: string
type: object
UserFactorPushTransactionRejected_allOf__links:
allOf:
- $ref: '#/components/schemas/LinksVerify'
- properties:
factor:
$ref: '#/components/schemas/UserFactor'
type: object
UserFactorPushTransactionTimeout_allOf__links:
allOf:
- $ref: '#/components/schemas/LinksVerify'
- properties:
factor:
$ref: '#/components/schemas/UserFactor'
type: object
UserFactorPushTransactionWaiting_allOf__links:
allOf:
- $ref: '#/components/schemas/LinksPoll'
- $ref: '#/components/schemas/LinksCancel'
UserFactorToken_allOf_verify:
oneOf:
- $ref: '#/components/schemas/UserFactorTokenVerifyRSA'
- $ref: '#/components/schemas/UserFactorTokenVerifySymantec'
UserFactorTokenHardware_allOf_verify:
properties:
passCode:
description: OTP for the current time window
example: cccccceukngdfgkukfctkcvfidnetljjiknckkcjulji
type: string
type: object
UserGetSingleton_allOf__embedded:
description: The embedded resources related to the object if the `expand` query
parameter is specified
example:
blocks:
- appliesTo: ANY_DEVICES
type: DEVICE_BASED
- appliesTo: ANY_DEVICES
type: DEVICE_BASED
properties:
blocks:
description: A list of access block details for the User account
items:
$ref: '#/components/schemas/UserBlock'
type: array
type: object
UserImportRequestData_action:
description: The object that specifies the default action Okta is set to take
properties:
result:
description: "The current default action that results when Okta imports\
\ a user. The two possible values are `CREATE_USER` and `LINK_USER`. You\
\ \ncan change the action that is taken by means of the commands object\
\ you return."
enum:
- CREATE_USER
- LINK_USER
type: string
x-enumDescriptions:
CREATE_USER: A new Okta user profile is created for the user
LINK_USER: The user is treated as a match for the existing Okta user identified
by the value of `data.user.id`
type: object
UserImportRequestData_appUser:
description: The app user profile being imported
properties:
profile:
additionalProperties:
type: string
description: "Provides the name-value pairs of the attributes contained\
\ in the app user profile of the user who is being imported. You can change\
\ \nthe values of attributes in the user's app profile by means of the\
\ `commands` object you return. If you change attributes in the app \n\
profile, they then flow through to the Okta user profile, based on matching\
\ and mapping rules."
type: object
type: object
UserImportRequestData_context_application:
description: Details of the app from which the user is being imported
properties:
name:
description: The app name
type: string
id:
description: The app ID
type: string
label:
description: The user-defined display name for the app
type: string
status:
description: The status of the app
enum:
- ACTIVE
- INACTIVE
type: string
type: object
UserImportRequestData_context_job:
description: The details of the running import job
properties:
id:
description: The ID number of the import job
type: string
type:
description: The type of import job
type: string
type: object
UserImportRequestData_context:
properties:
conflicts:
description: An array of user profile attributes that are in conflict
items:
additionalProperties: true
type: object
type: array
application:
$ref: '#/components/schemas/UserImportRequestData_context_application'
job:
$ref: '#/components/schemas/UserImportRequestData_context_job'
matches:
description: The list of Okta users currently matched to the app user based
on import matching. There can be more than one match.
items:
additionalProperties: true
type: object
type: array
policy:
description: The list of any policies that apply to the import matching
items:
additionalProperties: true
type: object
type: array
type: object
UserImportRequestData_user:
description: "Provides information on the Okta user profile currently set to\
\ be used for the user who is being imported, based on the matching \nrules\
\ and attribute mappings that were applied."
properties:
profile:
additionalProperties:
type: string
description: |-
The `data.user.profile` contains the name-value pairs of the attributes in the user profile. If the user has been matched to an existing
Okta user, a `data.user.id` object is included, containing the unique identifier of the Okta user profile.
You can change the values of the attributes by means of the `commands` object you return.
type: object
type: object
UserImportResponse_commands_inner:
properties:
type:
description: |-
The command types supported for the import inline hook.
When using the `com.okta.action.update` command to specify that the user should be treated as a match, you need to also provide a `com.okta.user.update` command that sets the ID of the Okta user.
enum:
- com.okta.appUser.profile.update
- com.okta.user.profile.update
- com.okta.action.update
- com.okta.user.update
type: string
x-enumDescriptions:
com.okta.appUser.profile.update: Change values of attributes in the user's
app user profile
com.okta.user.profile.update: Change values of attributes in the user's
Okta user profile
com.okta.action.update: Specify whether to create a new Okta user for
the user being imported or treat them as a match of an existing Okta
user
com.okta.user.update: Specify the existing Okta user that the imported
user should be treated as a match of.
value:
additionalProperties:
type: string
description: "The `value` object is the parameter to pass to the command.\
\ In the case of the `com.okta.appUser.profile.update` and `com.okta.user.profile.update`\
\ commands, \nthe parameter should be a list of one or more profile attributes\
\ and the values you wish to set them to. In the case of the `com.okta.action.update`\
\ command,\nthe parameter should be a `result` property set to either\
\ `CREATE_USER` or `LINK_USER`."
type: object
type: object
UserImportResponse_error:
description: "An object to return an error. Returning an error causes Okta to\
\ record a failure event in the Okta System Log. \nThe string supplied in\
\ the `errorSummary` property is recorded in the System Log event.\n\n>**Note:**\
\ If a response to an import inline hook request is not received from your\
\ external service within three seconds, a timeout occurs. In this scenario,\
\ the Okta import process continues and the user is created."
properties:
errorSummary:
description: A human-readable summary of the error
type: string
type: object
UserRiskGetResponse__links:
allOf:
- $ref: '#/components/schemas/LinksSelf'
- $ref: '#/components/schemas/LinksUserRef'
UserTypeLinks_allOf_schema:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: The associated schema
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
WellKnownAppAuthenticatorConfiguration_settings:
example:
userVerification: PREFERRED
properties:
userVerification:
$ref: '#/components/schemas/CustomAppUserVerificationEnum'
type: object
WellKnownOrgMetadata__links:
example:
organization:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
alternate:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
properties:
alternate:
$ref: '#/components/schemas/HrefObject'
organization:
$ref: '#/components/schemas/HrefObject'
type: object
orgBillingContactType__links_billing:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the org billing [Contact Type User](/openapi/okta-management/management/tag/OrgSettingContact/#tag/OrgSettingContact/operation/getOrgContactUser)\
\ resource"
orgBillingContactType__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the org billing Contact Type object using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
properties:
billing:
$ref: '#/components/schemas/orgBillingContactType__links_billing'
readOnly: true
type: object
orgGeneralSettingLinks_contacts:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Org Contacts](/openapi/okta-management/management/tag/OrgSettingContact/)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orgGeneralSettingLinks_logo:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: Link to the org logo
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orgGeneralSettingLinks_oktaCommunication:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Org Communication Settings](/openapi/okta-management/management/tag/OrgSettingCommunication/)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orgGeneralSettingLinks_oktaSupport:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Org Support Settings](/openapi/okta-management/management/tag/OrgSettingSupport/)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orgGeneralSettingLinks_preferences:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Org Preferences](/openapi/okta-management/management/tag/OrgSettingCustomization/#tag/OrgSettingCustomization/operation/getOrgPreferences)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orgGeneralSettingLinks_uploadLogo:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the [Upload Org Logo](/openapi/okta-management/management/tag/OrgSettingCustomization/#tag/OrgSettingCustomization/operation/uploadOrgLogo)\
\ resource"
example:
templated: true
hints:
allow:
- DELETE
- DELETE
name: name
href: href
type: type
orgTechnicalContactType__links_technical:
allOf:
- $ref: '#/components/schemas/HrefObject'
- description: "Link to the org technical [Contact Type User](/openapi/okta-management/management/tag/OrgSettingContact/#tag/OrgSettingContact/operation/getOrgContactUser)\
\ resource"
orgTechnicalContactType__links:
description: "Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288))\
\ available for the org technical Contact Type object using the [JSON Hypertext\
\ Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)\
\ specification"
properties:
technical:
$ref: '#/components/schemas/orgTechnicalContactType__links_technical'
readOnly: true
type: object
securitySchemes:
apiToken:
description: "Pass the API token as the Authorization header value prefixed\
\ with SSWS: `Authorization: SSWS {API Token}`"
in: header
name: Authorization
type: apiKey
oauth2:
description: "Pass the access_token as the value of the Authorization header:\
\ `Authorization: Bearer {access_token}`"
flows:
authorizationCode:
authorizationUrl: /oauth2/v1/authorize
scopes:
okta.agentPools.manage: Allows the app to create and manage agent pools
in your Okta organization
okta.agentPools.read: Allows the app to read agent pools in your Okta
organization
okta.apiTokens.manage: Allows the app to manage API Tokens in your Okta
organization
okta.apiTokens.read: Allows the app to read API Tokens in your Okta organization
okta.appGrants.manage: Allows the app to create and manage grants in your
Okta organization
okta.appGrants.read: Allows the app to read grants in your Okta organization
okta.apps.manage: Allows the app to create and manage Apps in your Okta
organization
okta.apps.read: Allows the app to read information about Apps in your
Okta organization
okta.authenticators.manage: "Allows the app to manage all authenticators.\
\ For example, enrollments or resets."
okta.authenticators.manage.self: "Allows the app to manage a user's own\
\ authenticators. For example, enrollments or resets."
okta.authenticators.read: Allows the app to read org authenticators information
okta.authorizationServers.manage: Allows the app to create and manage
Authorization Servers in your Okta organization
okta.authorizationServers.read: Allows the app to read information about
Authorization Servers in your Okta organization
okta.behaviors.manage: Allows the app to create and manage behavior detection
rules in your Okta organization
okta.behaviors.read: Allows the app to read behavior detection rules in
your Okta organization
okta.brands.manage: Allows the app to create and manage Brands and Themes
in your Okta organization
okta.brands.read: Allows the app to read information about Brands and
Themes in your Okta organization
okta.captchas.manage: Allows the app to create and manage CAPTCHAs in
your Okta organization
okta.captchas.read: Allows the app to read information about CAPTCHAs
in your Okta organization
okta.deviceAssurance.manage: Allows the app to manage device assurances
okta.deviceAssurance.read: Allows the app to read device assurances
okta.deviceChecks.manage: Allows the app to manage device checks
okta.deviceChecks.read: Allows the app to read device checks
okta.devices.manage: Allows the app to manage device status transitions
and delete a device
okta.devices.read: Allows the app to read the existing device's profile
and search devices
okta.directories.groups.manage: Allows the app to manage AD/LDAP Groups
for your Okta organization
okta.domains.manage: Allows the app to manage custom Domains for your
Okta organization
okta.domains.read: Allows the app to read information about custom Domains
for your Okta organization
okta.dr.manage: Allows the app to manage disaster recovery
okta.dr.read: Allows the app to read the disaster recovery status
okta.emailDomains.manage: Allows the app to manage Email Domains for your
Okta organization
okta.emailDomains.read: Allows the app to read information about Email
Domains for your Okta organization
okta.emailServers.manage: Allows the app to manage Email Servers for your
Okta organization
okta.emailServers.read: Allows the app to read information about Email
Servers for your Okta organization
okta.eventHooks.manage: Allows the app to create and manage Event Hooks
in your Okta organization
okta.eventHooks.read: Allows the app to read information about Event Hooks
in your Okta organization
okta.features.manage: Allows the app to create and manage Features in
your Okta organization
okta.features.read: Allows the app to read information about Features
in your Okta organization
okta.groups.manage: Allows the app to manage existing groups in your Okta
organization
okta.groups.read: Allows the app to read information about groups and
their members in your Okta organization
okta.identitySources.manage: Allows the custom identity sources to manage
user entities in your Okta organization
okta.identitySources.read: Allows to read session information for custom
identity sources in your Okta organization
okta.idps.manage: Allows the app to create and manage Identity Providers
in your Okta organization
okta.idps.read: Allows the app to read information about Identity Providers
in your Okta organization
okta.inlineHooks.manage: Allows the app to create and manage Inline Hooks
in your Okta organization
okta.inlineHooks.read: Allows the app to read information about Inline
Hooks in your Okta organization
okta.linkedObjects.manage: Allows the app to manage linked object definitions
in your Okta organization
okta.linkedObjects.read: Allows the app to read linked object definitions
in your Okta organization
okta.logStreams.manage: Allows the app to create and manage log streams
in your Okta organization
okta.logStreams.read: Allows the app to read information about log streams
in your Okta organization
okta.logs.read: Allows the app to read information about System Log entries
in your Okta organization
okta.manifests.manage: Allows the app to manage OIN submissions in your
Okta organization
okta.manifests.read: Allows the app to read OIN submissions in your Okta
organization
okta.networkZones.manage: Allows the app to create and manage Network
Zones in your Okta organization
okta.networkZones.read: Allows the app to read Network Zones in your Okta
organization
okta.oauthIntegrations.manage: Allows the app to create and manage API
service Integration instances in your Okta organization
okta.oauthIntegrations.read: Allows the app to read API service Integration
instances in your Okta organization
okta.orgs.manage: Allows the app to manage organization-specific details
for your Okta organization
okta.orgs.read: Allows the app to read organization-specific details about
your Okta organization
okta.personal.adminSettings.manage: Allows the app to manage the personal
admin settings for the signed-in user
okta.personal.adminSettings.read: Allows the app to read the personal
admin settings for the signed-in user
okta.policies.manage: Allows the app to manage policies in your Okta organization
okta.policies.read: Allows the app to read information about policies
in your Okta organization
okta.principalRateLimits.manage: Allows the app to create and manage Principal
Rate Limits in your Okta organization
okta.principalRateLimits.read: Allows the app to read information about
Principal Rate Limits in your Okta organization
okta.privilegedAccounts.manage: Allows the app to create and manage Privileged
Accounts in your Okta organization
okta.privilegedAccounts.read: Allows the app to read Privileged Accounts
in your Okta organization
okta.privilegedResources.manage: Allows the app to create privileged resources
and manage their details
okta.privilegedResources.read: Allows the app to read the details of existing
privileged resources
okta.profileMappings.manage: Allows the app to manage user profile mappings
in your Okta organization
okta.profileMappings.read: Allows the app to read user profile mappings
in your Okta organization
okta.pushProviders.manage: Allows the app to create and manage push notification
providers such as APNs and FCM
okta.pushProviders.read: Allows the app to read push notification providers
such as APNs and FCM
okta.rateLimits.manage: Allows the app to create and manage rate limits
in your Okta organization
okta.rateLimits.read: Allows the app to read information about rate limits
in your Okta organization
okta.realmAssignments.manage: Allows a user to manage realm assignments
okta.realmAssignments.read: Allows a user to read realm assignments
okta.realms.manage: Allows the app to create new realms and to manage
their details
okta.realms.read: Allows the app to read the existing realms and their
details
okta.resourceSelectors.manage: Allows the app to manage resource selectors
in your Okta org
okta.resourceSelectors.read: Allows the app to read resource selectors
in your Okta org
okta.riskEvents.manage: Allows the app to publish risk events to your
Okta organization
okta.riskProviders.manage: Allows the app to create and manage risk provider
integrations in your Okta organization
okta.riskProviders.read: Allows the app to read all risk provider integrations
in your Okta organization
okta.roles.manage: Allows the app to manage administrative role assignments
for users in your Okta organization. Delegated admins with this permission
can only manage user credential fields and not the credential values
themselves.
okta.roles.read: Allows the app to read administrative role assignments
for users in your Okta organization. Delegated admins with this permission
can only manage user credential fields and not the credential values
themselves.
okta.schemas.manage: Allows the app to create and manage Schemas in your
Okta organization
okta.schemas.read: Allows the app to read information about Schemas in
your Okta organization
okta.securityEventsProviders.manage: Allows the app to create and manage
Security Events Providers in your Okta organization
okta.securityEventsProviders.read: Allows the app to read information
about Security Events Providers in your Okta organization
okta.sessions.manage: Allows the app to manage all sessions in your Okta
organization
okta.sessions.read: Allows the app to read all sessions in your Okta organization
okta.templates.manage: Allows the app to manage all custom templates in
your Okta organization
okta.templates.read: Allows the app to read all custom templates in your
Okta organization
okta.threatInsights.manage: Allows the app to manage all ThreatInsight
configurations in your Okta organization
okta.threatInsights.read: Allows the app to read all ThreatInsight configurations
in your Okta organization
okta.trustedOrigins.manage: Allows the app to manage all Trusted Origins
in your Okta organization
okta.trustedOrigins.read: Allows the app to read all Trusted Origins in
your Okta organization
okta.uischemas.manage: Allows the app to manage all the UI Schemas in
your Okta organization
okta.uischemas.read: Allows the app to read all the UI Schemas in your
Okta organization
okta.userRisk.manage: Allows the app to manage a user's risk in your Okta
org
okta.userRisk.read: Allows the app to read a user's risk in your Okta
org
okta.userTypes.manage: Allows the app to manage user types in your Okta
org
okta.userTypes.read: Allows the app to read user types in your Okta org
okta.users.manage: Allows the app to create new users and to manage all
users' profile and credentials information
okta.users.manage.self: Allows the app to manage the signed-in user's
profile and credentials
okta.users.read: Allows the app to read the existing users' profiles and
credentials
okta.users.read.self: Allows the app to read the signed-in user's profile
and credentials
ssf.manage: Allows the app to create and manage Shared Signals Framework
(SSF) in your Okta organization
ssf.read: Allows the app to read information about Shared Signals Framework
(SSF) in your Okta organization
tokenUrl: /oauth2/v1/token
type: oauth2
x-webhooks:
CreateTelephonyInlineHook:
post:
summary: Create a Telephony Inline Hook
description: "Creates an Okta Telephony inline hook request. This is an automated\
\ request from Okta to your third-party service endpoint.\n\nThe objects that\
\ you return in the JSON payload of your response to this Okta request are\
\ an array of one or more objects,\nwhich specify the Okta commands to execute.\n\
\n>**Note:** The size of your response payload must be less than 256 KB.\n\
\nSee also:\n* For a general introduction to Okta inline hooks, see [Inline\
\ hooks](https://developer.okta.com/docs/concepts/inline-hooks/)\n* For information\
\ on the API for registering external service endpoints with Okta, see [Inline\
\ Hooks Management API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/)\n\
* For an example implementation of a telephony inline hook, see [Telephony\
\ inline hook ](https://developer.okta.com/docs/guides/telephony-inline-hook)\n\
\n### About\n\nThe Okta telephony inline hook allows you to integrate your\
\ own custom code into Okta flows that send SMS or voice call messages. You\
\ can integrate this hook with enrollment, authentication, and recovery flows\
\ that involve the phone authenticator. Okta uses your external provider to\
\ deliver the one-time passcode (OTP) to the Requester. The provider can respond\
\ with commands that indicate if the delivery was successful or not.\n\nYou\
\ can have only one active telephony inline hook per org.\n\nWhen you create\
\ a telephony inline hook, you must include the `authScheme` parameter. See\
\ [Create inline hook](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createInlineHook)\
\ and the [authScheme object](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createInlineHook!path=channel/0/config/authScheme&t=request)\n\
\n### Time-out behavior\n\nIf the provider response times out, Okta attempts\
\ to send the OTP using the Okta telephony providers. See [Troubleshoot](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createTelephonyInlineHook/#troubleshoot).\n\
\n>**Note:** The failover mechanism that uses the Okta telephony providers\
\ is heavily rate-limited.\n\n### Troubleshoot\n\nThis section explains several\
\ common causes of failure for telephony inline hooks.\n\nNote: Administrators\
\ can use the [Okta System Log](https://developer.okta.com/docs/reference/api/system-log/)\
\ to view errors. See the Troubleshooting section in the inline hooks topic\
\ for details on events captured by the Okta System Log.\n\n| Issue \
\ \
\ | Impact \
\ | Error Visibility |\
\ \n|-------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------|-------------------------------------------|\n\
|External service fails to communicate or times out \
\ | Inline hook operation is skipped, OTP is sent to the Requester\
\ using an Okta telephony provider | Administrators only \
\ |\n|External service responds with any HTTP status code besides `200`\
\ | Inline hook operation is skipped, OTP is sent to the\
\ Requester using an Okta telephony provider | Administrators only \
\ | \n|External service returns an error object \
\ | Inline hook operation fails, OTP is sent\
\ to the Requester using an Okta telephony provider | Administrators,\
\ developers, and end users |\n|Hook response is malformed or can't be mapped\
\ to the expected API response | Inline hook operation is skipped\
\ | Administrators\
\ only |\n|Request header doesn't include an `authScheme`\
\ | Inline hook operation is skipped\
\ | Administrators\
\ only |\n|Response uses an invalid status \
\ | Inline hook operation is skipped\
\ | Administrators\
\ only |\n|Operation adds an active telephony inline\
\ hook when a hook exists | Inline hook operation is skipped\
\ | Administrators\
\ only |"
operationId: createTelephonyInlineHook
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/TelephonyRequest'
examples:
TelephonyPayloadExample:
$ref: '#/components/examples/TelephonyPayloadExample'
responses:
"200":
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/TelephonyResponse'
examples:
TelephonySuccessResponse:
$ref: '#/components/examples/TelephonySuccessResponse'
TelephonyFailureResponse:
$ref: '#/components/examples/TelephonyFailureResponse'
"403":
$ref: '#/components/responses/ErrorAccessDenied403'
security:
- apiToken: []
- oauth2: []
tags:
- InlineHook
CreatePasswordImportInlineHook:
post:
summary: Create a Password Import Inline Hook
description: "Creates a password import inline hook request, one type of inline\
\ hook supported by Okta. This is an automated request from Okta to your third-party\
\ service endpoint. This reference provides sample JSON objects that are contained\
\ in the outbound request from Okta to your external service,\nand sample\
\ JSON objects that you can include in your response. The objects that you\
\ return in the JSON payload of your response to this Okta request are an\
\ array of one or more objects,\nwhich specify the Okta commands to execute.\n\
\n>**Note:** The size of your response payload must be less than 256 KB.\n\
\nThe password import inline hook allows you to migrate users from another\
\ data store where you want the users to retain their current passwords.\n\
Use this hook with the [Create User with password import inline hook](https://developer.okta.com/docs/reference/api/users/#create-user-with-password-import-inline-hook)\
\ flow that's provided by the [Users API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/User/).\n\
\nThe password import inline hook is triggered when the user tries to sign\
\ in to Okta for the first time. Okta sends your external service the password\
\ that the user supplied. Your external service then needs to send a response\
\ to Okta indicating whether the password supplied by the end user is valid.\n\
\nIf your service returns a response that indicates that the password is valid,\
\ Okta sets the password for the user. The password import inline hook won't\
\ need to call your service again.\nHowever, if the Okta service is in read-only\
\ mode, it might not be possible to set the password. Okta then needs to call\
\ your service again the next time the user attempts to sign in.\nSee [Password\
\ inline hook and Okta read-only mode](#password-inline-hook-and-okta-read-only-mode)\
\ and [Removing password from existing user store](#password-removal-from-an-existing-user-store).\n\
\n>**Notes:**\n> * Password policies don't apply to the password import inline\
\ hook. That is, if your external service validates the password, the password\
\ is imported even if it doesn't meet the Okta password policy requirements.\n\
> * You can create only one password import inline hook per org.\n\nSee also:\n\
\n * [Inline hooks](https://developer.okta.com/docs/concepts/inline-hooks/)\
\ for a general introduction to Okta inline hooks\n * [Inline Hooks Management\
\ API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/)\
\ for information on the API for registering external service endpoints with\
\ Okta\n * [Add an inline hook](https://help.okta.com/okta_help.htm?type=oie&id=ext-add-inline-hook)\
\ for steps to enable this inline hook in the Admin Console\n * [Password\
\ import inline hook](https://developer.okta.com/docs/guides/password-import-inline-hook/nodejs/main/)\
\ for an example implementation of this inline hook\n\n### Enable a password\
\ import inline hook\n\nTo enable a password import inline hook, you first\
\ need to register your external service endpoint with Okta and configure\
\ it as an inline hook of type `com.okta.user.credential.password.import`.\n\
You can enable the hook using the Admin Console, see [Add an inline hook](https://help.okta.com/okta_help.htm?type=oie&id=ext-add-inline-hook)\
\ or through the [Inline Hooks management API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/).\n\
When creating a user with the Users API, you need to use the [Create User\
\ with password import inline hook](https://developer.okta.com/docs/reference/api/users/#create-user-with-password-import-inline-hook)\
\ use case.\nThis involves specifying a `credentials.password.hook` property\
\ in the request body.\n\nWhen the user that you have added attempts to sign\
\ in to Okta for the first time, the hook is triggered and Okta calls your\
\ external service. The call sends the credentials that the end user provided.\
\ Your service can check\nthe credentials and respond with a command to indicate\
\ whether the credentials are valid or not.\n\n### Password inline hook and\
\ Okta read-only mode\n\nIf your external service responds to Okta indicating\
\ that the credentials are valid, Okta saves the password and can authenticate\
\ the user independently from then on. However, if your Okta org is in a special\
\ [read-only mode](https://support.okta.com/help/s/article/What-is-Oktas-Readonly-Mode)\n\
at the time the user signs in, then saving the password might not be possible.\
\ The next time the end user attempts to sign in, the password import inline\
\ hook needs to be called again.\n\n### Password removal from an existing\
\ user store\n\nBecause of the possibility of your org being in a special\
\ service mode, you shouldn't attempt to permanently delete user passwords\
\ from your existing user store until you can verify the success of the password\
\ import . An Okta System Log Event, `user.import.password`, is available\
\ for this purpose. An event of this type is created every time a password\
\ import inline hook is fired, with its `Event.Outcome` property providing\
\ a status of `FAILURE` or `SUCCESS` for the password import operation. \n\
If the status is `SUCCESS`, Okta has successfully saved the end user's password,\
\ and it's safe to delete it from your previous user store.\n\nYou can configure\
\ an [Event hook](https://developer.okta.com/docs/concepts/event-hooks/) to\
\ send this event type to you for use when triggering automated cleanup of\
\ end-user\npasswords after successful migration."
operationId: createPasswordImportInlineHook
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/PasswordImportRequest'
examples:
PasswordImportPayloadExample:
$ref: '#/components/examples/PasswordImportPayloadExample'
responses:
"200":
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/PasswordImportResponse'
examples:
PasswordImportVerifiedResponse:
$ref: '#/components/examples/PasswordImportVerifiedResponse'
PasswordImportUnVerifiedResponse:
$ref: '#/components/examples/PasswordImportUnVerifiedResponse'
"204":
description: No content - Unverified user response
"403":
$ref: '#/components/responses/ErrorAccessDenied403'
security:
- apiToken: []
- oauth2: []
tags:
- InlineHook
create-registration-hook:
post:
summary: Create a Registration Inline Hook
description: |-
Creates a registration inline hook request, one type of inline hook supported by Okta. This is an automated request from Okta to your third-party service endpoint. This reference provides sample JSON objects that are contained in the outbound request from Okta to your external service,
and sample JSON objects that you can include in your response. The objects that you return in the JSON payload of your response to this Okta request are an array of one or more objects,
which specify the Okta commands to execute.
The Okta registration inline hook allows you to integrate your own custom code into Okta's [Profile Enrollment](https://help.okta.com/okta_help.htm?type=oie&id=ext-create-profile-enrollment) flow. The hook is triggered after Okta receives the registration or profile update request. Your custom code can:
- Allow or deny the registration attempt, based on your own validation of the information the user has submitted
- Set or override the values that are populated in attributes of the user's Okta profile
> **Note:** Profile Enrollment and self-service registration (SSR) inline hooks only work with the [Okta Sign-In Widget](https://developer.okta.com/code/javascript/okta_sign-in_widget/) version 4.5 or later.
See also:
* [Inline hooks](https://developer.okta.com/docs/concepts/inline-hooks/) for a general introduction to Okta inline hooks
* [Inline Hooks Management API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/) for information on the API for registering external service endpoints with Okta
* [Add an inline hook](https://help.okta.com/okta_help.htm?type=oie&id=ext-add-inline-hook) for steps to enable this inline hook in the Admin Console
* [Registration inline hook](https://developer.okta.com/docs/guides/registration-inline-hook) for an example implementation of this inline hook
operationId: create-registration-hook
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/RegistrationInlineHookRequest'
examples:
ProfileEnrollmentRequest:
$ref: '#/components/examples/ProfileEnrollmentRequest'
ProgressiveProfileRequest:
$ref: '#/components/examples/ProgressiveProfileRequest'
responses:
"200":
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/RegistrationResponse'
examples:
ProfileEnrollmentResponse:
$ref: '#/components/examples/ProfileEnrollmentResponse'
ProgressiveProfileResponse:
$ref: '#/components/examples/ProgressiveProfileResponse'
ProfileEnrollmentResponseDeny:
$ref: '#/components/examples/ProfileEnrollmentResponseDeny'
ProgressiveProfileResponseDeny:
$ref: '#/components/examples/ProgressiveProfileResponseDeny'
"204":
description: No content - Allow registration to proceed without any update.
tags:
- InlineHook
security:
- apiToken: []
- oauth2: []
x-okta-no-scope-required: true
CreateUserImportInlineHook:
post:
summary: Create a User Import Inline Hook
description: "Creates a user import inline hook request, one type of inline\
\ hook supported by Okta. This is an automated request from Okta to your third-party\
\ service endpoint. \nThis reference provides sample JSON objects that are\
\ contained in the outbound request from Okta to your external service, and\
\ sample JSON objects that you can include \nin your response. The objects\
\ that you return in the JSON payload of your response to this Okta request\
\ are an array of one or more objects, which specify the Okta commands to\
\ execute.\n\nThe user import inline hook enables you to add custom logic\
\ to the process of importing new users into Okta from an app. You can resolve\
\ conflicts in user name or other profile attributes, \nmodify values of profile\
\ attributes, and control whether the imported user is treated as a match\
\ for an existing user or not. The hook is invoked for each user being imported,\
\ \nat the point immediately after any applicable profile attribute mappings\
\ have been applied, and any potential matches with existing users have been\
\ found, but before the Okta user profile is created.\n\n>**Note:** If the\
\ external service times out after receiving an Okta request, the Okta process\
\ flow continues and the user is created.\n\nSee also:\n* [Inline hooks](https://developer.okta.com/docs/concepts/inline-hooks/)\
\ for a general introduction to Okta inline hooks\n* [Inline Hooks Management\
\ API](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/InlineHook/)\
\ for information on the API for registering external service endpoints with\
\ Okta\n* [Add an inline hook](https://help.okta.com/okta_help.htm?type=oie&id=ext-add-inline-hook)\
\ for steps to enable this inline hook in the Admin Console\n\n>**Note:**\
\ The procedure for associating a user import inline hook with an app using\
\ the Admin Console can't be used with AD or LDAP."
operationId: createUserImportInlineHook
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/UserImportRequest'
examples:
UserImportPayloadExample:
$ref: '#/components/examples/UserImportPayloadExample'
responses:
"200":
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/UserImportResponse'
examples:
UserImportChangeAppUserProfileExample:
$ref: '#/components/examples/UserImportChangeAppUserProfileExample'
UserImportChangeUserProfileExample:
$ref: '#/components/examples/UserImportChangeUserProfileExample'
UserImportCreateANewUserExample:
$ref: '#/components/examples/UserImportCreateANewUserExample'
UserImportMatchExample:
$ref: '#/components/examples/UserImportMatchExample'
UserImportErrorExample:
$ref: '#/components/examples/UserImportErrorExample'
"204":
description: No content - Use the default action
"403":
$ref: '#/components/responses/ErrorAccessDenied403'
security:
- apiToken: []
- oauth2: []
tags:
- InlineHook
create-saml-hook:
post:
summary: Create a SAML Assertion Inline Hook
description: |-
Creates a SAML Assertion inline hook request, one type of inline hook supported by Okta. This is an automated request from Okta to your third-party service endpoint. This reference provides sample JSON objects that are contained in the outbound request from Okta to your external service, and sample JSON objects that you can include in your response. The objects that you return in the JSON payload of your response to this Okta request are an array of one or more objects, which specify the Okta commands to execute.
This type of inline hook is triggered when Okta generates a SAML assertion in response to an authentication request. Before sending the SAML assertion to the app that will consume it, Okta calls out to your external service. Your external service can respond with commands to add attributes to the assertion or to modify its existing attributes.
You can use this functionality to add data to assertions, which might be data that is sensitive, calculated at runtime, or complexly-structured and not appropriate for storing in Okta user profiles. Data added this way is never logged or stored by Okta. As an example, SAML assertions generated for a medical app could be augmented with confidential patient data provided by your external service and not stored in Okta.
This inline hook works only when using custom SAML apps, not apps from the OIN.
See also:
* [Inline hooks](https://developer.okta.com/docs/concepts/inline-hooks/) for a general introduction to Okta inline hooks
* [Inline Hooks Management API](/openapi/okta-management/management/tag/InlineHook/) for information on the API for registering external service endpoints with Okta
* For a use case example of how to implement a SAML assertion inline hook, see [SAML assertion inline hook](https://developer.okta.com/docs/guides/saml-inline-hook)
* For steps to enable this inline hook, see [Add an inline hook](https://help.okta.com/okta_help.htm?type=oie&id=ext-add-inline-hook).
### Specify location within the assertion
Specify the location within the assertion where you want to apply your operation using a slash-delimited path, which follows JSON Patch conventions.
When you perform an `add` op to add a new attribute statement, begin with `/claims/` and follow that with the name of the new attribute that you're adding.
When you modify an existing assertions statement, begin the path with `/subject/`, `/authentication/`, `/conditions/`, or `/claims/`, depending on which part of the assertion you want to modify. You then look deeper within the child elements using slash-delimited element names, for example, `/claims/array/attributeValues/1/value`. (The `/1/` in the path indicates the index of the array, using zero-based indexing.)
### URI claims
Okta supports URI claims with SAML assertion hooks. When you need to replace or add a URI claim, encode the claim name within the command per the [JavaScript Object Notation (JSON) Pointer](https://tools.ietf.org/html/rfc6901) specification. Specifically, this replaces `~` with `~0` and `/` with `~1`.
### SessionNotOnOrAfter support
In some scenarios, your service provider may require the `SessionNotOnOrAfter` attribute for the `<saml:AuthnStatement>` in the SAML assertion, which sets the provider session time correctly. Use `add` op with the path `/authentication/sessionLifetime` and a value for session lifetime in seconds to add this attribute. Okta calculates `SessionNotOnOrAfter` by adding the `/authentication/sessionLifetime` value to the `issueInstant` attribute and returns it in the SAML `data.assertion.
operationId: createSAMLAssertionInlineHook
requestBody:
required: true
content:
application/json:
schema:
allOf:
- $ref: '#/components/schemas/InlineHookBasePayload'
- $ref: '#/components/schemas/SAMLPayLoad'
examples:
SAMLPayloadExample:
$ref: '#/components/examples/SAMLPayLoadExample'
responses:
"200":
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/SAMLHookResponse'
examples:
SAMLHookResponseExample:
$ref: '#/components/examples/SAMLHookResponseExample'
SAMLHookResponseWithURIFormat:
$ref: '#/components/examples/SAMLHookResponseWithURIFormat'
"204":
description: No content - Use the default action
"403":
$ref: '#/components/responses/ErrorAccessDenied403'
security:
- apiToken: []
- oauth2: []
tags:
- InlineHook
create-token-hook:
post:
summary: Create a Token inline hook
description: "Creates a Token inline hook request, one type of inline hook supported\
\ by Okta. This is an automated request from Okta to your third-party service\
\ endpoint. This reference provides sample JSON objects that are contained\
\ in the outbound request from Okta to your external service, and sample JSON\
\ objects that you can include in your response.\n\nThis type of inline hook\
\ is triggered when OAuth 2.0 and OpenID Connect (OIDC) tokens are minted\
\ by your Okta custom authorization server. Before sending the token to the\
\ requester, Okta calls out to your external service. Your service can then\
\ respond with commands to add custom claims to the token or to modify existing\
\ claims.\n\nUse this functionality to add data that is sensitive, calculated\
\ at runtime, or complexly structured and not appropriate for storing in Okta\
\ user profiles. Okta never logs nor stores data that is added this way. As\
\ an example, tokens minted for a medical app could be augmented with confidential\
\ patient data provided by your external service and not stored in Okta.\n\
\nIn addition to adding custom claims, you can modify or remove an existing\
\ custom claim or an OIDC standard profile claim. You can also update how\
\ long an access token or an ID token is valid.\n\nThis inline hook works\
\ only when using an [Okta custom authorization server](https://developer.okta.com/docs/guides/customize-authz-server/main/#create-an-authorization-server),\
\ not the built-in Okta org authorization server.\n\nSee also:\n * [Inline\
\ hooks](https://developer.okta.com/docs/concepts/inline-hooks/) for a general\
\ introduction to Okta inline hooks\n * [Inline Hooks Management API](/openapi/okta-management/management/tag/InlineHook/)\
\ for information on the API for registering external service endpoints with\
\ Okta\n * For an example implementation of this inline hook, see [Token\
\ inline hook](https://developer.okta.com/docs/guides/token-inline-hook)\n\
\n### Timeout behavior\nAfter receiving the Okta request, if there's a response\
\ timeout, the Okta process flow proceeds with the original token returned.\n\
\n### Enabling a token inline hook\nTo activate the inline hook, you first\
\ need to register your external service endpoint with Okta using the [Inline\
\ Hooks Management API](/openapi/okta-management/management/tag/InlineHook).\n\
You then need to associate the registered inline hook with a custom authorization\
\ server policy rule by completing the following steps:\n1. Go to **Security**\
\ > **API** > **Authorization Servers.**\n2. Select a custom authorization\
\ server from the list.\n3. Select **Access Policies** and select a policy\
\ to use with the hook. In most cases, pick the Default Policy.\n4. One of\
\ the policy's rules needs to trigger the inline hook. Click the pencil icon\
\ for a rule to edit it. If you only have one rule, edit the Default Policy\
\ Rule.\n5. Click the **Use this Inline Hook** dropdown menu. Any inline hooks\
\ that you have registered are listed. Select the hook that you would like\
\ to use.\n6. Click **Update Rule**.\n\n> **Note:** You can associate only\
\ one inline hook with each rule.\n\n### Troubleshoot\nThis section covers\
\ what happens when a token inline hook flow fails either due to the external\
\ inline hook service returning an error object or not returning a successful\
\ response, or the inline hook patch fails.\n> **Note:** Administrators can\
\ use the [Okta System Log](https://developer.okta.com/docs/reference/api/system-log/)\
\ to view errors. See the [Troubleshooting](https://developer.okta.com/docs/concepts/inline-hooks/#troubleshooting)\
\ section in the inline hooks concept piece for more information on the events\
\ related to inline hooks that the Okta System Log captures.\n- When there's\
\ a communication failure with the external service, a timeout for example,\
\ the inline hook operation is skipped. The token is generated without any\
\ modification from the inline hook.\n \n **Who can see this error?** Administrators\n\
\n- When the external service returns a response with any other HTTP status\
\ code besides `200`, the inline hook operation is skipped. The token is generated\
\ without any modification from the inline hook.\n \n **Who can see this\
\ error?** Administrators\n\n- When the external service returns an error\
\ object in the response, the entire token inline hook flow fails with no\
\ token generated.\n \n **Who can see this error?** Administrators, developers,\
\ and end users. When the OAuth 2.0 client receives the error, the client\
\ developer can see that error if the client has the debug information. What\
\ the end user sees depends on how errors are handled within the client.\n\
\ > **Note:** See the [error](https://developer.okta.com/docs/reference/token-hook/#error)\
\ section on this page for more information on what to include in the error\
\ object of your response and what the OAuth 2.0 error includes that Okta\
\ returns to the requestor of the token.\n\n- When a hook command (for example,\
\ updating, adding, and deleting claims) can't be performed, the inline hook\
\ operation is skipped. The token is generated without any modification from\
\ the inline hook.\n \n **Who can see this error?** Administrators\n\n \
\ The following actions result in an error:\n - Using an invalid command.\
\ For example, if only an ID token is requested, the `commands` array shouldn't\
\ contain commands of the type `com.okta.access.patch`.\n - Using an invalid\
\ operation\n - Attempting to remove a system-specific claim\n - Attempting\
\ to update a claim that doesn't exist\n - Attempting to update an element\
\ within an array that doesn't exist or specifying an invalid index\n -\
\ Attempting to remove a claim that doesn't exist"
operationId: createTokenInlineHook
requestBody:
required: true
content:
application/json:
schema:
$ref: '#/components/schemas/TokenRequest'
examples:
TokenPayLoadExample:
$ref: '#/components/examples/TokenPayLoadExample'
responses:
"200":
description: Successful response
content:
application/json:
schema:
$ref: '#/components/schemas/TokenHookResponse'
examples:
TokenHookResponse:
$ref: '#/components/examples/TokenHookResponse'
TokenHookResponseWithURIFormat:
$ref: '#/components/examples/TokenHookResponseWithURIFormat'
TokenHookResponseAppendArray:
$ref: '#/components/examples/TokenHookResponseAppendArray'
TokenHookReplaceExisting:
$ref: '#/components/examples/TokenHookReplaceExisting'
TokenHookReplaceInPath:
$ref: '#/components/examples/TokenHookReplaceInPath'
TokenHookModifyLifetime:
$ref: '#/components/examples/TokenHookModifyLifetime'
TokenHookRemoveClaim:
$ref: '#/components/examples/TokenHookRemoveClaim'
TokenHookRemoveFromArray:
$ref: '#/components/examples/TokenHookRemoveFromArray'
TokenHookRemoveFromObject:
$ref: '#/components/examples/TokenHookRemoveFromObject'
TokenHookErrorExample:
$ref: '#/components/examples/TokenHookErrorExample'
"204":
description: No content - Unverified user response
"403":
$ref: '#/components/responses/ErrorAccessDenied403'
security:
- apiToken: []
- oauth2: []
tags:
- InlineHook
</code></pre> <br/>
<br/>
<div class='clear'></div>
</main>
</div>
<br/><br/>
<div class="align-center">© 2015 - 2025 <a href="/legal-notice.php">Weber Informatics LLC</a> | <a href="/data-protection.php">Privacy Policy</a></div>
<br/><br/><br/><br/><br/><br/>
</body>
</html>
<script data-cfasync="false" src="/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js"></script>