Okta Management API

Enumerates apps added to your organization with pagination. A subset of apps can be returned that match a supported filter expression or query. Mocked via Mockzilla.

Adds a new application to your Okta organization.

Removes an inactive application.

Fetches an application from your Okta organization by id.

Updates an application in your organization.

Get default Provisioning Connection for application. Available as a Mockzilla mock endpoint.

Set default Provisioning Connection for application

Activates the default Provisioning Connection for an application.

Deactivates the default Provisioning Connection for an application.

Enumerates Certificate Signing Requests for an application

Generates a new key pair and returns the Certificate Signing Request for it. Mockzilla mock: no signup, no API key.

Enumerates key credentials for an application

Generates a new X.509 certificate for an application key credential

Gets a specific application key credential by kid

Clones a X.509 certificate for an application key credential from a source application to target application.

Enumerates the client's collection of secrets. Served by the Mockzilla mock runtime.

Adds a new secret to the client's collection of secrets.

Removes a secret from the client's collection of secrets.

Gets a specific client secret by secretId

Activates a specific client secret by secretId

Deactivates a specific client secret by secretId. Mocked via Mockzilla.

List Features for application

Fetches a Feature object for an application.

Updates a Feature object for an application.

Lists all scope consent grants for the application

Grants consent for the application to request an OAuth 2.0 Okta scope. Available as a Mockzilla mock endpoint.

Revokes permission for the application to request the given scope

Fetches a single scope consent grant for the application

Enumerates group assignments for an application.

Removes a group assignment from an application.

Fetches an application group assignment. Mockzilla mock: no signup, no API key.

Assigns a group to an application

Activates an inactive application.

Deactivates an active application.

Update the logo for an application.

Assign an application to a specific policy. This unassigns the application from its currently assigned policy. Served by the Mockzilla mock runtime.

Previews SAML metadata based on a specific key credential for an application

Revokes all tokens for the specified application

Lists all tokens for the application

Revokes the specified token for the specified application

Gets a token for the specified application. Mocked via Mockzilla.

Enumerates all assigned application users for an application.

Assigns an user to an application with credentials and an app-specific profile. Profile mappings defined for the application are first applied before applying any profile properties specified in the request.

Removes an assignment for a user from an application.

Fetches a specific user assignment for application by id.

Updates a user's profile for an application. Available as a Mockzilla mock endpoint.

List Authenticators

Create Authenticator

Success

Updates an authenticator

Success. Mockzilla mock: no signup, no API key.

Success

Success

Success

Success

Success. Served by the Mockzilla mock runtime.

Success

Success

Success

Success

Success. Mocked via Mockzilla.

Success

Success

Success

Success

Success. Available as a Mockzilla mock endpoint.

Success

Success

Success

Success

Success. Mockzilla mock: no signup, no API key.

Success

Success

Success

Success

Success. Served by the Mockzilla mock runtime.

Activate Authorization Server Policy

Deactivate Authorization Server Policy

Enumerates all policy rules for the specified Custom Authorization Server and Policy.

Creates a policy rule for the specified Custom Authorization Server and Policy.

Deletes a Policy Rule defined in the specified Custom Authorization Server and Policy. Mocked via Mockzilla.

Returns a Policy Rule by ID that is defined in the specified Custom Authorization Server and Policy.

Updates the configuration of the Policy Rule defined in the specified Custom Authorization Server and Policy.

Activate Authorization Server Policy Rule

Deactivate Authorization Server Policy Rule

Success. Available as a Mockzilla mock endpoint.

Success

Success

Success

Success

List all the brands in your org. Mockzilla mock: no signup, no API key.

Fetches a brand by brandId

Updates a brand by brandId

List email templates in your organization with pagination.

Fetch an email template by templateName

Delete all customizations for an email template. Also known as “Reset to Default”. Served by the Mockzilla mock runtime.

List all email customizations for an email template

Create an email customization

Delete an email customization

Fetch an email customization by id.

Update an email customization. Mocked via Mockzilla.

Get a preview of an email template customization.

Fetch the default content for an email template.

Fetch a preview of an email template's default content by populating velocity references with the current user's environment.

Send a test email to the current users primary and secondary email addresses. The email content is selected based on the following priority: An email customization specifically for the users locale. The default language of email customizations. The email templates default content.

List all the themes in your brand. Available as a Mockzilla mock endpoint.

Fetches a theme for a brand

Updates a theme for a brand

Deletes a Theme background image

Updates the background image for your Theme

Deletes a Theme favicon. The org then uses the Okta default favicon. Mockzilla mock: no signup, no API key.

Updates the favicon for your theme

Deletes a Theme logo. The org then uses the Okta default logo.

Updates the logo for your Theme

List all verified custom Domains for the org.

Creates your domain. Served by the Mockzilla mock runtime.

Deletes a Domain by id.

Fetches a Domain by id.

Creates the Certificate for the Domain.

Verifies the Domain by id.

Success. Mocked via Mockzilla.

Success

Success

Success

Success

Success. Available as a Mockzilla mock endpoint.

Success

Success

Success

Success

Success. Mockzilla mock: no signup, no API key.

Success

Success

Enumerates groups in your organization with pagination. A subset of groups can be returned that match a supported filter expression or query.

Adds a new group with OKTA_GROUP type to your organization.

Lists all group rules for your organization. Served by the Mockzilla mock runtime.

Creates a group rule to dynamically add users to the specified group if they match the condition

Removes a specific group rule by id from your organization

Fetches a specific group rule by id from your organization

Updates a group rule. Only INACTIVE rules can be updated.

Activates a specific group rule by id from your organization. Mocked via Mockzilla.

Deactivates a specific group rule by id from your organization

Removes a group with OKTA_GROUP type from your organization.

Fetches a group from your organization.

Updates the profile for a group with OKTA_GROUP type from your organization.

Enumerates all applications that are assigned to a group. Available as a Mockzilla mock endpoint.

Success

Assigns a Role to a Group

Unassigns a Role from a Group

Success

Lists all App targets for an APP_ADMIN Role assigned to a Group. This methods return list may include full Applications or Instances. The response for an instance will have an ID value, while Application will not have an ID. Mockzilla mock: no signup, no API key.

Success

Success

Remove App Instance Target to App Administrator Role given to a Group

Add App Instance Target to App Administrator Role given to a Group

Success. Served by the Mockzilla mock runtime.

Enumerates all users that are a member of a group.

Removes a user from a group with 'OKTA_GROUP' type.

Adds a user to a group with 'OKTA_GROUP' type.

Enumerates IdPs in your organization with pagination. A subset of IdPs can be returned that match a supported filter expression or query.

Adds a new IdP to your organization. Mocked via Mockzilla.

Enumerates IdP key credentials.

Adds a new X.509 certificate credential to the IdP key store.

Deletes a specific IdP Key Credential by kid if it is not currently being used by an Active or Inactive IdP.

Gets a specific IdP Key Credential by kid

Removes an IdP from your organization. Available as a Mockzilla mock endpoint.

Fetches an IdP by id.

Updates the configuration for an IdP.

Enumerates Certificate Signing Requests for an IdP

Generates a new key pair and returns a Certificate Signing Request for it.

Revoke a Certificate Signing Request and delete the key pair from the IdP. Mockzilla mock: no signup, no API key.

Gets a specific Certificate Signing Request model by id

Update the Certificate Signing Request with a signed X.509 certificate and add it into the signing key credentials for the IdP.

Enumerates signing key credentials for an IdP

Generates a new X.509 certificate for an IdP signing key credential to be used for signing assertions sent to the IdP

Gets a specific IdP Key Credential by kid. Served by the Mockzilla mock runtime.

Clones a X.509 certificate for an IdP signing key credential from a source IdP to target IdP

Activates an inactive IdP.

Deactivates an active IdP.

Find all the users linked to an identity provider

Removes the link between the Okta user and the IdP user. Mocked via Mockzilla.

Fetches a linked IdP user by ID

Links an Okta user to an existing Social Identity Provider. This does not support the SAML2 Identity Provider Type

Fetches the tokens minted by the Social Authentication Provider when the user authenticates with Okta via Social Auth.

Success

Success. Available as a Mockzilla mock endpoint.

Deletes the Inline Hook matching the provided id. Once deleted, the Inline Hook is unrecoverable. As a safety precaution, only Inline Hooks with a status of INACTIVE are eligible for deletion.

Gets an inline hook by ID

Updates an inline hook by ID

Executes the Inline Hook matching the provided inlineHookId using the request body as the input. This will send the provided data through the Channel and return a response if it matches the correct data contract. This execution endpoint should only be used for testing purposes.

Activates the Inline Hook matching the provided id. Mockzilla mock: no signup, no API key.

Deactivates the Inline Hook matching the provided id

The Okta System Log API provides read access to your organization’s system log. This API provides more functionality than the Events API

Enumerates Profile Mappings in your organization with pagination.

Fetches a single Profile Mapping referenced by its ID.

Updates an existing Profile Mapping by adding, updating, or removing one or many Property Mappings. Served by the Mockzilla mock runtime.

Fetches the Schema for an App User

Partial updates on the User Profile properties of the Application User Schema.

Fetches the group schema

Updates, adds ore removes one or more custom Group Profile properties in the schema

Success. Mocked via Mockzilla.

Success

Success

Success

Fetches the schema for a Schema Id.

Partial updates on the User Profile properties of the user schema. Available as a Mockzilla mock endpoint.

Fetches all User Types in your org

Creates a new User Type. A default User Type is automatically created along with your org, and you may add another 9 User Types for a maximum of 10.

Deletes a User Type permanently. This operation is not permitted for the default type, nor for any User Type that has existing users

Fetches a User Type by ID. The special identifier default may be used to fetch the default User Type.

Updates an existing User Type. Mockzilla mock: no signup, no API key.

Replace an existing User Type

Get settings of your organization.

Partial update settings of your organization.

Update settings of your organization.

Gets Contact Types of your organization. Served by the Mockzilla mock runtime.

Retrieves the URL of the User associated with the specified Contact Type.

Updates the User associated with the specified Contact Type.

Updates the logo for your organization.

Gets preferences of your organization.

Hide the Okta UI footer for all end users of your organization. Mocked via Mockzilla.

Makes the Okta UI footer visible for all end users of your organization.

Gets Okta Communication Settings of your organization.

Opts in all users of this org to Okta Communication emails.

Opts out all users of this org from Okta Communication emails.

Gets Okta Support Settings of your organization. Available as a Mockzilla mock endpoint.

Extends the length of time that Okta Support can access your org by 24 hours. This means that 24 hours are added to the remaining access time.

Enables you to temporarily allow Okta Support to access your org as an administrator for eight hours.

Revokes Okta Support access to your organization.

Gets all policies with the specified type.

Creates a policy. Mockzilla mock: no signup, no API key.

Removes a policy.

Gets a policy.

Updates a policy.

Activates a policy.

Deactivates a policy. Served by the Mockzilla mock runtime.

Enumerates all policy rules.

Creates a policy rule.

Removes a policy rule.

Gets a policy rule.

Updates a policy rule. Mocked via Mockzilla.

Activates a policy rule.

Deactivates a policy rule.

When roleType List all subscriptions of a Role. Else when roleId List subscriptions of a Custom Role

When roleType Get subscriptions of a Role with a specific notification type. Else when roleId Get subscription of a Custom Role with a specific notification type.

When roleType Subscribes a Role to a specific notification type. When you change the subscription status of a Role, it overrides the subscription of any individual user of that Role. Else when roleId Subscribes a Custom Role to a specific notification type. When you change the subscription status of a Custom Role, it overrides the subscription of any individual user of that Custom Role. Available as a Mockzilla mock endpoint.

When roleType Unsubscribes a Role from a specific notification type. When you change the subscription status of a Role, it overrides the subscription of any individual user of that Role. Else when roleId Unsubscribes a Custom Role from a specific notification type. When you change the subscription status of a Custom Role, it overrides the subscription of any individual user of that Custom Role.

Creates a new session for a user with a valid session token. Use this API if, for example, you want to set the session cookie yourself instead of allowing Okta to set it, or want to hold the session ID in order to delete a session via the API instead of visiting the logout URL.

Get details about a session.

Enumerates custom SMS templates in your organization. A subset of templates can be returned that match a template type.

Adds a new custom SMS template to your organization. Mockzilla mock: no signup, no API key.

Removes an SMS template.

Fetches a specific template by id

Updates only some of the SMS template properties:

Updates the SMS template.

Gets current ThreatInsight configuration. Served by the Mockzilla mock runtime.

Updates ThreatInsight configuration

Success

Success

Success

Success. Mocked via Mockzilla.

Success

Success

Success

Lists users that do not have a status of 'DEPROVISIONED' (by default), up to the maximum (200 for most orgs), with pagination in most cases. A subset of users can be returned that match a supported filter expression or search criteria.

Creates a new user in your Okta organization with or without credentials. Available as a Mockzilla mock endpoint.

Deletes a user permanently. This operation can only be performed on users that have a DEPROVISIONED status. This action cannot be recovered!

Fetches a user from your Okta organization.

Update a user's profile or credentials with partial update semantics.

Update a user's profile and/or credentials using strict-update semantics.

Fetches appLinks for all direct or indirect (via group membership) assigned applications. Mockzilla mock: no signup, no API key.

Lists all client resources for which the specified user has grants or tokens.

Revokes all grants for the specified user and client

Lists all grants for a specified user and client

Revokes all refresh tokens issued for the specified User and Client.

Lists all refresh tokens issued for the specified User and Client. Served by the Mockzilla mock runtime.

Revokes the specified refresh token.

Gets a refresh token issued for the specified User and Client.

Changes a user's password by validating the user's current password. This operation can only be performed on users in STAGED, ACTIVE, PASSWORD_EXPIRED, or RECOVERY status that have a valid password credential

Changes a user's recovery question & answer credential by validating the user's current password. This operation can only be performed on users in STAGED, ACTIVE or RECOVERY status that have a valid password credential

Enumerates all the enrolled factors for the specified user. Mocked via Mockzilla.

Enrolls a user with a supported factor.

Enumerates all the supported factors that can be enrolled for the specified user

Enumerates all available security questions for a user's question factor

Unenrolls an existing factor for the specified user, allowing the user to enroll a new factor.

Fetches a factor for the specified user. Available as a Mockzilla mock endpoint.

The sms and token:software:totp factor types require activation to complete the enrollment process.

Polls factors verification transaction for status.

Verifies an OTP for a token or token:hardware factor

Revokes all grants for a specified user

Lists all grants for the specified user. Mockzilla mock: no signup, no API key.

Revokes one grant for a specified user

Gets a grant for the specified user

Fetches the groups of which the user is a member.

Lists the IdPs associated with the user.

Activates a user. This operation can only be performed on users with a STAGED status. Activation of a user is an asynchronous operation. The user will have the transitioningToStatus property with a value of ACTIVE during activation to indicate that the user hasn't completed the asynchronous operation. The user will have a status of ACTIVE when the activation process is complete. Served by the Mockzilla mock runtime.

Deactivates a user. This operation can only be performed on users that do not have a DEPROVISIONED status. While the asynchronous operation (triggered by HTTP header Prefer: respond-async) is proceeding the user's transitioningToStatus property is DEPROVISIONED. The user's status is DEPROVISIONED when the deactivation process is complete.

This operation transitions the user to the status of PASSWORD_EXPIRED so that the user is required to change their password at their next login.

This operation transitions the user to the status of PASSWORD_EXPIRED and the user's password is reset to a temporary password that is returned.

Reactivates a user. This operation can only be performed on users with a PROVISIONED status. This operation restarts the activation workflow if for some reason the user activation was not completed when using the activationToken from Activate User.

This operation resets all factors for the specified user. All MFA factor enrollments returned to the unenrolled state. The user's status remains ACTIVE. This link is present only if the user is currently enrolled in one or more MFA factors. Mocked via Mockzilla.

Generates a one-time token (OTT) that can be used to reset a user's password. The OTT link can be automatically emailed to the user or returned to the API caller and distributed using a custom flow.

Suspends a user. This operation can only be performed on users with an ACTIVE status. The user will have a status of SUSPENDED when the process is complete.

Unlocks a user with a LOCKED_OUT status and returns them to ACTIVE status. Users will be able to login with their current password.

Unsuspends a user and returns them to the ACTIVE state. This operation can only be performed on users that have a SUSPENDED status.

Delete linked objects for a user, relationshipName can be ONLY a primary relationship name. Available as a Mockzilla mock endpoint.

Get linked objects for a user, relationshipName can be a primary or associated relationship name

Lists all roles assigned to a user.

Assigns a role to a user.

Unassigns a role from a user.

Gets role that is assigne to user. Mockzilla mock: no signup, no API key.

Lists all App targets for an APP_ADMIN Role assigned to a User. This methods return list may include full Applications or Instances. The response for an instance will have an ID value, while Application will not have an ID.

Success

Success

Success

Remove App Instance Target to App Administrator Role given to a User. Served by the Mockzilla mock runtime.

Add App Instance Target to App Administrator Role given to a User

Success

Success

Success

Removes all active identity provider sessions. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user. Mocked via Mockzilla.

List subscriptions of a User. Only lists subscriptions for current user. An AccessDeniedException message is sent if requests are made from other users.

Get the subscriptions of a User with a specific notification type. Only gets subscriptions for current user. An AccessDeniedException message is sent if requests are made from other users.

Subscribes a User to a specific notification type. Only the current User can subscribe to a specific notification type. An AccessDeniedException message is sent if requests are made from other users.

Unsubscribes a User from a specific notification type. Only the current User can unsubscribe from a specific notification type. An AccessDeniedException message is sent if requests are made from other users.

Enumerates network zones added to your organization with pagination. A subset of zones can be returned that match a supported filter expression or query. Available as a Mockzilla mock endpoint.

Adds a new network zone to your Okta organization.

Removes network zone.

Fetches a network zone from your Okta organization by id.

Updates a network zone in your organization.

Activate Network Zone. Mockzilla mock: no signup, no API key.

Deactivates a network zone.