Use Okta to search and manage users, update profiles, reset passwords or MFA factors, clear sessions, and manage groups and group rules. The actions also inspect or change application assignments and admin roles and query the System Log.
Choose an account and API token with the permissions required for the selected action. User lifecycle and access changes affect real accounts; confirm the target user or group before executing them.
Manage users, groups, and group rules. Run service desk actions like resetting MFA factors and clearing sessions. Review and change application assignments and admin roles. Query the System Log to audit sign-ins and admin changes.
List users in your Okta organization with optional search and filtering. Users with a DEPROVISIONED status are omitted unless a search or filter expression selects them.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) searchstring No Okta search expression (e.g., profile.firstName eq "John" or profile.email co "example.com") filterstring No Okta filter expression (e.g., status eq "ACTIVE") afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of users to return per page (default: 200)
Parameter Type Description usersarray Array of Okta user objects ↳ id string User ID ↳ status string User status (ACTIVE, STAGED, PROVISIONED, etc.) ↳ firstName string First name ↳ lastName string Last name ↳ email string Email address ↳ login string Login (usually email) ↳ mobilePhone string Mobile phone ↳ title string Job title ↳ department string Department ↳ created string Creation timestamp ↳ lastLogin string Last login timestamp ↳ lastUpdated string Last update timestamp ↳ activated string Activation timestamp ↳ statusChanged string Status change timestamp countnumber Number of users returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more users are available successboolean Operation success status
Get a specific user by ID or login from your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login (email) to look up
Parameter Type Description idstring User ID statusstring User status firstNamestring First name lastNamestring Last name emailstring Email address loginstring Login (usually email) mobilePhonestring Mobile phone secondEmailstring Secondary email displayNamestring Display name titlestring Job title departmentstring Department organizationstring Organization managerstring Manager name managerIdstring Manager ID divisionstring Division employeeNumberstring Employee number userTypestring User type createdstring Creation timestamp activatedstring Activation timestamp lastLoginstring Last login timestamp lastUpdatedstring Last update timestamp statusChangedstring Status change timestamp passwordChangedstring Password change timestamp successboolean Operation success status
Create a new user in your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) firstNamestring Yes First name of the user lastNamestring Yes Last name of the user emailstring Yes Email address of the user loginstring No Login for the user (defaults to email if not provided) passwordstring No Password for the user (if not set, user will be emailed to set password) mobilePhonestring No Mobile phone number titlestring No Job title departmentstring No Department activateboolean No Whether to activate the user immediately (default: true)
Parameter Type Description idstring Created user ID statusstring User status firstNamestring First name lastNamestring Last name emailstring Email address loginstring Login createdstring Creation timestamp lastUpdatedstring Last update timestamp successboolean Operation success status
Update a user profile in your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login to update firstNamestring No Updated first name lastNamestring No Updated last name emailstring No Updated email address loginstring No Updated login mobilePhonestring No Updated mobile phone number titlestring No Updated job title departmentstring No Updated department
Parameter Type Description idstring User ID statusstring User status firstNamestring First name lastNamestring Last name emailstring Email address loginstring Login createdstring Creation timestamp lastUpdatedstring Last update timestamp successboolean Operation success status
Activate a user in your Okta organization. Can only be performed on users with STAGED or DEPROVISIONED status. Optionally sends an activation email.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login to activate sendEmailboolean No Send activation email to the user (default: true)
Parameter Type Description userIdstring Activated user ID activatedboolean Whether the user was activated activationUrlstring Activation URL (only returned when sendEmail is false) activationTokenstring Activation token (only returned when sendEmail is false) successboolean Operation success status
Deactivate a user in your Okta organization. This transitions the user to DEPROVISIONED status.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login to deactivate sendEmailboolean No Send deactivation email to admin (default: false)
Parameter Type Description userIdstring Deactivated user ID deactivatedboolean Whether the user was deactivated successboolean Operation success status
Suspend a user in your Okta organization. Only users with ACTIVE status can be suspended. Suspended users cannot log in but retain group and app assignments.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login to suspend
Parameter Type Description userIdstring Suspended user ID suspendedboolean Whether the user was suspended successboolean Operation success status
Unsuspend a previously suspended user in your Okta organization. Returns the user to ACTIVE status.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login to unsuspend
Parameter Type Description userIdstring Unsuspended user ID unsuspendedboolean Whether the user was unsuspended successboolean Operation success status
Generate a one-time token to reset a user password. Can email the reset link to the user or return it directly. Transitions the user to RECOVERY status.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login to reset password for sendEmailboolean No Send password reset email to the user. Okta requires this parameter and declares no default of its own; leaving it blank sends the email
Parameter Type Description userIdstring User ID resetPasswordUrlstring Password reset URL (only returned when sendEmail is false) successboolean Operation success status
Permanently delete a user from your Okta organization. Can only be performed on DEPROVISIONED users. If the user is active, this will first deactivate them and a second call is needed to delete.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login (email) to delete sendEmailboolean No Send deactivation email to admin (default: false)
Parameter Type Description userIdstring Deleted user ID deletedboolean Whether the delete request was accepted. An ACTIVE user is deactivated by the first call and needs a second call to actually be deleted. successboolean Operation success status
List all groups in your Okta organization with optional search and filtering
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) searchstring No Okta search expression for groups (e.g., profile.name sw "Engineering" or type eq "OKTA_GROUP") filterstring No Okta filter expression (e.g., type eq "OKTA_GROUP") afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of groups to return per page (max: 10000)
Parameter Type Description groupsarray Array of Okta group objects ↳ id string Group ID ↳ name string Group name ↳ description string Group description ↳ type string Group type (OKTA_GROUP, APP_GROUP, BUILT_IN) ↳ created string Creation timestamp ↳ lastUpdated string Last update timestamp ↳ lastMembershipUpdated string Last membership change timestamp countnumber Number of groups returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more groups are available successboolean Operation success status
Get a specific group by ID from your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupIdstring Yes Group ID to look up
Parameter Type Description idstring Group ID namestring Group name descriptionstring Group description typestring Group type createdstring Creation timestamp lastUpdatedstring Last update timestamp lastMembershipUpdatedstring Last membership change timestamp successboolean Operation success status
Create a new group in your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) namestring Yes Name of the group descriptionstring No Description of the group
Parameter Type Description idstring Created group ID namestring Group name descriptionstring Group description typestring Group type createdstring Creation timestamp lastUpdatedstring Last update timestamp lastMembershipUpdatedstring Last membership change timestamp successboolean Operation success status
Update a group profile in your Okta organization. Only groups of OKTA_GROUP type can be updated. Fields left blank keep their stored value.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupIdstring Yes Group ID to update namestring No Updated group name. Leave blank to keep the stored name descriptionstring No Updated group description
Parameter Type Description idstring Group ID namestring Group name descriptionstring Group description typestring Group type createdstring Creation timestamp lastUpdatedstring Last update timestamp lastMembershipUpdatedstring Last membership change timestamp successboolean Operation success status
Delete a group from your Okta organization. Groups of OKTA_GROUP or APP_GROUP type can be removed.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupIdstring Yes Group ID to delete
Parameter Type Description groupIdstring Deleted group ID deletedboolean Whether the group was deleted successboolean Operation success status
Add a user to a group in your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupIdstring Yes Group ID to add the user to userIdstring Yes User ID to add to the group
Parameter Type Description groupIdstring Group ID userIdstring User ID added to the group addedboolean Whether the user was added successboolean Operation success status
Remove a user from a group in your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupIdstring Yes Group ID to remove the user from userIdstring Yes User ID to remove from the group
Parameter Type Description groupIdstring Group ID userIdstring User ID removed from the group removedboolean Whether the user was removed successboolean Operation success status
List all members of a specific group in your Okta organization
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupIdstring Yes Group ID to list members for afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of members to return per page (default: 1000, but Okta recommends 200)
Parameter Type Description membersarray Array of group member user objects ↳ id string User ID ↳ status string User status ↳ firstName string First name ↳ lastName string Last name ↳ email string Email address ↳ login string Login ↳ mobilePhone string Mobile phone ↳ title string Job title ↳ department string Department ↳ created string Creation timestamp ↳ lastLogin string Last login timestamp ↳ lastUpdated string Last update timestamp ↳ activated string Activation timestamp ↳ statusChanged string Status change timestamp countnumber Number of members returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more members are available successboolean Operation success status
List the group rules in your Okta organization. Each rule assigns users to groups automatically based on an expression over their profile, so this shows how group membership is being driven.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) searchstring No Keyword to search group rules for afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of rules to return (default: 50, max: 200)
Parameter Type Description rulesarray Array of group rules ↳ id string Group rule ID ↳ name string Group rule name ↳ type string Rule type, always group_rule ↳ status string Rule status (ACTIVE, INACTIVE, INVALID) ↳ created string Creation timestamp ↳ lastUpdated string Last update timestamp ↳ expression string Okta expression that decides which users the rule matches ↳ expressionType string Expression language, typically urn:okta:expression:1.0 ↳ assignUserToGroupIds array Groups that matching users are assigned to ↳ excludedUserIds array Users excluded from the rule ↳ excludedGroupIds array Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. countnumber Number of rules returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more rules are available successboolean Operation success status
Retrieve a single Okta group rule by ID, including the expression that decides which users it matches and the groups those users are assigned to.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupRuleIdstring Yes Group rule ID to look up
Parameter Type Description idstring Group rule ID namestring Group rule name typestring Rule type, always group_rule statusstring Rule status (ACTIVE, INACTIVE, INVALID) createdstring Creation timestamp lastUpdatedstring Last update timestamp expressionstring Okta expression that decides which users the rule matches expressionTypestring Expression language, typically urn:okta:expression:1.0 assignUserToGroupIdsarray Groups that matching users are assigned to excludedUserIdsarray Users excluded from the rule excludedGroupIdsarray Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. successboolean Operation success status
Create a group rule that automatically assigns users matching an Okta expression to one or more groups. New rules are created INACTIVE, so run Activate Group Rule afterwards to start applying it.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) ruleNamestring Yes Name for the group rule (maximum 50 characters) expressionstring Yes Okta expression that must evaluate to a boolean (e.g., user.department=="Engineering") assignUserToGroupIdsstring Yes Comma-separated group IDs that matching users are assigned to excludedUserIdsstring No Comma-separated user IDs to exclude from the rule
Parameter Type Description idstring Created group rule ID namestring Group rule name typestring Rule type, always group_rule statusstring Rule status, which is INACTIVE for a newly created rule createdstring Creation timestamp lastUpdatedstring Last update timestamp expressionstring Okta expression that decides which users the rule matches expressionTypestring Expression language, typically urn:okta:expression:1.0 assignUserToGroupIdsarray Groups that matching users are assigned to excludedUserIdsarray Users excluded from the rule excludedGroupIdsarray Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. successboolean Operation success status
Activate a group rule so Okta starts applying it, assigning every matching user to the target groups.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupRuleIdstring Yes Group rule ID to activate
Parameter Type Description groupRuleIdstring Activated group rule ID activatedboolean Whether the rule was activated successboolean Operation success status
Deactivate a group rule so Okta stops applying it. Existing memberships the rule created are left in place. A rule must be INACTIVE before it can be edited.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupRuleIdstring Yes Group rule ID to deactivate
Parameter Type Description groupRuleIdstring Deactivated group rule ID deactivatedboolean Whether the rule was deactivated successboolean Operation success status
Permanently delete a group rule. Destructive and irreversible. Optionally also removes the users that this rule had assigned from those groups, which revokes any access those groups grant.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) groupRuleIdstring Yes Group rule ID to delete removeUsersboolean No Also remove the users this rule assigned from the groups it targeted (default: false)
Parameter Type Description groupRuleIdstring Deleted group rule ID deletedboolean Whether the deletion was accepted. Okta answers 202 and removes the rule asynchronously. successboolean Operation success status
List the MFA factors a user has enrolled, with each factor type, provider, and enrollment status. Use this before resetting a factor to confirm which one to target.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) to list enrolled factors for
Parameter Type Description factorsarray Array of enrolled MFA factors ↳ id string Factor ID ↳ factorType string Factor type (sms, call, email, push, question, token:software:totp, webauthn, etc.) ↳ provider string Factor provider (OKTA, GOOGLE, FIDO, DUO, RSA, SYMANTEC, YUBICO, CUSTOM) ↳ vendorName string Factor vendor name ↳ status string Enrollment status (ACTIVE, PENDING_ACTIVATION, NOT_SETUP, etc.) ↳ created string Enrollment timestamp ↳ lastUpdated string Last update timestamp ↳ profile json Factor-specific attributes, which vary by factor type (phone number, email, question, credential ID) countnumber Number of enrolled factors successboolean Operation success status
Retrieve a single enrolled MFA factor for a user, including its type, provider, enrollment status, and factor-specific profile.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) the factor belongs to factorIdstring Yes Factor ID to look up
Parameter Type Description idstring Factor ID factorTypestring Factor type providerstring Factor provider vendorNamestring Factor vendor name statusstring Enrollment status createdstring Enrollment timestamp lastUpdatedstring Last update timestamp profilejson Factor-specific attributes, which vary by factor type (phone number, email, question, credential ID) successboolean Operation success status
Enroll an MFA factor for a user. The profile fields required depend on the factor type: a phone number for sms and call, an email address for email, and a question and answer for question. Factors that enroll from the user device, such as webauthn and push, need no profile fields.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) to enroll the factor for factorTypestring Yes Factor type to enroll (sms, call, email, question, push, token:software:totp, u2f, webauthn) providerstring Yes Factor provider (OKTA, GOOGLE, FIDO, DUO, RSA, SYMANTEC, YUBICO, CUSTOM). Each provider supports a subset of factor types phoneNumberstring No Phone number in E.164 format. Required for the sms and call factor types factorEmailstring No Email address to enroll. Required for the email factor type securityQuestionstring No Security question key (e.g., disliked_food). Required for the question factor type securityAnswerstring No Answer to the security question, minimum 4 characters. Required for the question factor type activateboolean No Activate the factor immediately as part of enrollment. Supported by the sms, call, email, and token:hotp factor types (default: false)
Parameter Type Description idstring Enrolled factor ID factorTypestring Factor type providerstring Factor provider vendorNamestring Factor vendor name statusstring Enrollment status, typically PENDING_ACTIVATION until the user activates it createdstring Enrollment timestamp lastUpdatedstring Last update timestamp profilejson Factor-specific attributes, which vary by factor type (phone number, email, question, credential ID) enrolledboolean Whether the factor was enrolled successboolean Operation success status
Unenroll one specific MFA factor for a user so they can re-enroll it. Destructive and irreversible: the existing enrollment is removed. Unenrolling a push or signed_nonce factor also unenrolls the related Okta Verify factors. Factors cannot be unenrolled from a deactivated user.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) the factor belongs to factorIdstring Yes Factor ID to unenroll removeRecoveryEnrollmentboolean No Also remove the phone number as a recovery method, not only as a factor. Applies to sms and call factors only (default: false)
Parameter Type Description userIdstring User the factor belonged to factorIdstring Unenrolled factor ID resetboolean Whether the factor was unenrolled successboolean Operation success status
Reset every MFA factor for a user, returning all enrollments to the unenrolled state. Destructive and irreversible: the user must re-enroll each factor before they can complete MFA again. The user status stays ACTIVE.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes User ID or login whose MFA factors will all be reset
Parameter Type Description userIdstring User whose factors were reset resetboolean Whether all factors were reset successboolean Operation success status
Revoke every active Okta session for a user, signing them out of all devices immediately. Destructive and irreversible: the user must sign in again. Optionally also revokes their OAuth and OpenID Connect tokens, and clears remembered factors.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) whose sessions will be revoked oauthTokensboolean No Also revoke the user OpenID Connect and OAuth refresh and access tokens (default: false) forgetDevicesboolean No Clear the user remembered factors for all devices (default: true)
Parameter Type Description userIdstring User whose sessions were revoked clearedboolean Whether the sessions were revoked successboolean Operation success status
Retrieve an Okta session by ID, including who it belongs to, when it expires, and which authentication methods were used to establish it.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) sessionIdstring Yes Session ID to look up
Parameter Type Description idstring Session ID loginstring Login of the session user userIdstring ID of the session user statusstring Session status (ACTIVE, MFA_ENROLL, MFA_REQUIRED) createdAtstring Session creation timestamp expiresAtstring Session expiry timestamp lastPasswordVerificationstring Timestamp of the last password verification lastFactorVerificationstring Timestamp of the last factor verification amrarray Authentication methods used to establish the session idpIdstring Identity provider ID idpTypestring Identity provider type successboolean Operation success status
Revoke a single Okta session by ID, ending that sign-in immediately. Destructive and irreversible: the affected user must sign in again on that device.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) sessionIdstring Yes Session ID to revoke
Parameter Type Description sessionIdstring Revoked session ID revokedboolean Whether the session was revoked successboolean Operation success status
List the applications configured in your Okta organization, with optional name search, filtering, and cursor pagination.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) qstring No Search for applications whose name or label starts with this value filterstring No Okta filter expression (e.g., status eq "ACTIVE") includeNonDeletedboolean No Also return inactive applications. Deleted applications stay excluded either way (default: false) afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of applications to return (max: 200)
Parameter Type Description appsarray Array of Okta applications ↳ id string Application ID ↳ name string Application name (the app template key) ↳ label string Application display label ↳ status string Application status (ACTIVE, INACTIVE, DELETED) ↳ signOnMode string Sign-on mode (SAML_2_0, OPENID_CONNECT, BOOKMARK, etc.) ↳ features array Enabled provisioning features ↳ created string Creation timestamp ↳ lastUpdated string Last update timestamp countnumber Number of applications returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more applications are available successboolean Operation success status
Retrieve a single Okta application by ID, including its sign-on mode, status, enabled provisioning features, and configuration objects.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to look up
Parameter Type Description idstring Application ID namestring Application name (the app template key) labelstring Application display label statusstring Application status (ACTIVE, INACTIVE, DELETED) signOnModestring Sign-on mode featuresarray Enabled provisioning features createdstring Creation timestamp lastUpdatedstring Last update timestamp accessibilityjson Access settings for the app ↳ errorRedirectUrl string Custom error page URL ↳ loginRedirectUrl string Custom login page URL ↳ selfService boolean Whether users can self-assign the app visibilityjson Visibility settings for the app ↳ appLinks json Map of app link name to whether it appears on the End-User Dashboard ↳ autoLaunch boolean Signs in to the app automatically when the user signs in to Okta ↳ autoSubmitToolbar boolean Signs in automatically when the user lands on the sign-in page ↳ hide json Which end-user apps hide this app ↳ iOS boolean Hidden in Okta Mobile ↳ web boolean Hidden on the Okta End-User Dashboard settingsjson Application settings. Okta types these per app kind, so settings.app differs between a SAML, OIDC, bookmark, or SWA app profilejson Application profile attributes. Okta accepts any valid JSON schema here, so the shape is whatever the org configured successboolean Operation success status
List the users assigned to an Okta application, including how each assignment was made and its provisioning sync state. Use this to audit who has access to an app.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to list assigned users for qstring No Search assigned users whose userName, firstName, lastName, or email starts with this value afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of assigned users to return (default: 50, max: 500)
Parameter Type Description appUsersarray Array of application user assignments ↳ id string Okta user ID ↳ externalId string ID of the user in the downstream application ↳ created string Assignment creation timestamp ↳ lastUpdated string Last update timestamp ↳ scope string How the assignment was made: USER (direct) or GROUP (inherited) ↳ status string Assignment status ↳ statusChanged string Status change timestamp ↳ passwordChanged string App password change timestamp ↳ syncState string Provisioning sync state ↳ lastSync string Last provisioning sync ↳ userName string Username the user signs in to the application with ↳ profile json App-specific profile attributes, whose shape is set by the app schema countnumber Number of assignments returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more assignments are available successboolean Operation success status
Assign a user to an Okta application, granting them access to it. Applications that require credentials also need the username the user signs in with.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to assign the user to userIdstring Yes Okta user ID to assign scopestring No Assignment scope: USER for a direct assignment, or GROUP appUserNamestring No Username the user signs in to the application with. Required by applications that store credentials
Parameter Type Description idstring Okta user ID that was assigned externalIdstring ID of the user in the downstream application createdstring Assignment creation timestamp lastUpdatedstring Last update timestamp scopestring Assignment scope (USER or GROUP) statusstring Assignment status statusChangedstring Status change timestamp passwordChangedstring App password change timestamp syncStatestring Provisioning sync state lastSyncstring Last provisioning sync userNamestring Username the user signs in to the application with profilejson App-specific profile attributes, whose shape is set by the app schema assignedboolean Whether the user was assigned successboolean Operation success status
Unassign a user from an Okta application, revoking their access. Destructive and irreversible: the app profile for that user is permanently removed, and if provisioning is enabled the downstream account is deactivated.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to remove the user from userIdstring Yes Okta user ID to unassign sendEmailboolean No Send a deactivation email to the administrator (default: false)
Parameter Type Description appIdstring Application ID userIdstring User unassigned from the application removedboolean Whether the user was unassigned successboolean Operation success status
List the groups assigned to an Okta application. Every member of an assigned group inherits access to the app, so this is the starting point for an app access review.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to list assigned groups for qstring No Search assigned groups whose name starts with this value afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of assigned groups to return (default: 20, range: 20 to 200)
Parameter Type Description appGroupsarray Array of application group assignments ↳ id string Assigned group ID ↳ priority number Assignment priority, which resolves conflicting profile mappings ↳ lastUpdated string Last update timestamp ↳ profile json App-specific profile attributes, whose shape is set by the app schema countnumber Number of assignments returned nextCursorstring Cursor for the next page, or null on the last page hasMoreboolean Whether more assignments are available successboolean Operation success status
Assign a group to an Okta application so every member of the group inherits access to it.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to assign the group to groupIdstring Yes Group ID to assign prioritynumber No Assignment priority, which resolves conflicting profile mappings when a user belongs to several assigned groups
Parameter Type Description idstring Assigned group ID prioritynumber Assignment priority lastUpdatedstring Last update timestamp profilejson App-specific profile attributes, whose shape is set by the app schema assignedboolean Whether the group was assigned successboolean Operation success status
Unassign a group from an Okta application. Destructive: every member who had access only through this group loses access to the app.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) appIdstring Yes Application ID to remove the group from groupIdstring Yes Group ID to unassign
Parameter Type Description appIdstring Application ID groupIdstring Group unassigned from the application removedboolean Whether the group was unassigned successboolean Operation success status
List the administrator roles assigned to a user. Returns both standard roles and custom role bindings, so you can review who holds privileged access.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) to list admin roles for
Parameter Type Description rolesarray Array of admin role assignments ↳ id string Role assignment ID, which is the resource set binding ID for a custom role. Pass this to Remove User Role ↳ label string Role label ↳ type string Role type (SUPER_ADMIN, ORG_ADMIN, APP_ADMIN, USER_ADMIN, HELP_DESK_ADMIN, READ_ONLY_ADMIN, CUSTOM, etc.) ↳ status string Role status (ACTIVE, INACTIVE) ↳ created string Assignment timestamp ↳ lastUpdated string Last update timestamp ↳ assignmentType string How the role was assigned (USER, GROUP, CLIENT) ↳ role string Custom role ID, present only on custom role assignments ↳ resourceSet string Resource set ID, present only on custom role assignments countnumber Number of role assignments returned successboolean Operation success status
Grant a user an administrator role. Use a standard role type such as USER_ADMIN or HELP_DESK_ADMIN, or CUSTOM together with a custom role ID and a resource set ID. This grants privileged access, so confirm the role is the least privilege that fits.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) to assign the admin role to roleTypestring Yes Role type to assign: SUPER_ADMIN, ORG_ADMIN, APP_ADMIN, USER_ADMIN, HELP_DESK_ADMIN, READ_ONLY_ADMIN, API_ACCESS_MANAGEMENT_ADMIN, GROUP_MEMBERSHIP_ADMIN, REPORT_ADMIN, WORKFLOWS_ADMIN, ACCESS_CERTIFICATIONS_ADMIN, ACCESS_REQUESTS_ADMIN, or CUSTOM customRoleIdstring No Custom role ID. Required when the role type is CUSTOM resourceSetIdstring No Resource set ID the custom role applies to. Required when the role type is CUSTOM disableNotificationsboolean No Grant the user third-party admin status, which suppresses Okta admin notifications (default: false)
Parameter Type Description idstring Role assignment ID, which is what Remove User Role takes labelstring Role label typestring Assigned role type statusstring Role status createdstring Assignment timestamp lastUpdatedstring Last update timestamp assignmentTypestring How the role was assigned (USER, GROUP, CLIENT) rolestring Custom role ID, for custom roles resourceSetstring Resource set ID, for custom roles assignedboolean Whether the role was assigned successboolean Operation success status
Revoke an administrator role from a user. Destructive: the user immediately loses the admin permissions that role granted. Takes the role assignment ID, not the role type, which List User Roles returns as the role id field.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) userIdstring Yes Okta user ID (not a login or email) to revoke the admin role from roleAssignmentIdstring Yes Role assignment ID to revoke, as returned by List User Roles. For a custom role this is the resource set binding ID
Parameter Type Description userIdstring User the role was revoked from roleAssignmentIdstring Revoked role assignment ID removedboolean Whether the role was revoked successboolean Operation success status
Query the Okta System Log for sign-ins, admin changes, and security events. Supports a time window, SCIM filter expressions, keyword search, and cursor pagination for audit and investigation workflows.
Parameter Type Required Description apiKeystring Yes Okta API token for authentication domainstring Yes Okta domain (e.g., dev-123456.okta.com) sincestring No Start of the query time window as an ISO 8601 timestamp (default: 7 days before "until"). Ignored when a cursor is supplied in "after", which already encodes the resume position untilstring No End of the query time window as an ISO 8601 timestamp (default: now) filterstring No SCIM filter expression (e.g., eventType eq "user.session.start" or outcome.result eq "FAILURE") qstring No Keyword search across the event payload (max 40 characters per keyword, max 10 keywords) sortOrderstring No Sort order: ASCENDING (default) or DESCENDING afterstring No Opaque pagination cursor returned as nextCursor by a previous call limitnumber No Maximum number of events to return (default: 100, max: 1000)
Parameter Type Description eventsarray Array of System Log events ↳ uuid string Unique event ID ↳ published string Event timestamp ↳ eventType string Event type (e.g., user.session.start, user.account.update_password) ↳ severity string Event severity (DEBUG, ERROR, INFO, WARN) ↳ legacyEventType string Legacy event type ↳ displayMessage string Human-readable event description ↳ outcomeResult string Event outcome (SUCCESS, FAILURE, CHALLENGE, DENY, etc.) ↳ outcomeReason string Reason for the outcome ↳ actorId string ID of the actor ↳ actorType string Actor type (User, Client, etc.) ↳ actorAlternateId string Actor alternate ID, usually the login ↳ actorDisplayName string Actor display name ↳ clientIpAddress string Client IP address ↳ clientDevice string Client device category (e.g., Computer) ↳ clientZone string Network zone ↳ clientBrowser string Client browser ↳ clientOs string Client operating system ↳ clientCity string Client city ↳ clientState string Client state or region ↳ clientCountry string Client country ↳ authenticationProvider string Authentication provider used ↳ credentialType string Credential type used ↳ externalSessionId string External session ID for correlating events ↳ securityAsOrg string Autonomous system organization ↳ securityIsp string Internet service provider ↳ securityIsProxy boolean Whether the request came through a proxy ↳ transactionId string Transaction ID ↳ transactionType string Transaction type (e.g., WEB, JOB) ↳ targets array Entities the event acted upon ↳ id string Target ID ↳ type string Target type ↳ alternateId string Target alternate ID ↳ displayName string Target display name ↳ debugData json Extra context whose keys depend on the event type. Okta states these keys and values can change between releases, so treat them as a debugging aid rather than a contract countnumber Number of events returned nextCursorstring Cursor to resume from, or null when Okta advertised no next link. On a polling query it stays set on an empty page so the next scheduled run resumes from here rather than replaying from the start hasMoreboolean Whether more events are available. A query with no "until" is a polling query, which Okta always answers with a next link even when there are no new events, so this reports false once a page comes back empty successboolean Operation success status