# Okta (/integrations/okta)





{/* MANUAL-CONTENT-START:intro */}

Use [Okta](https://www.okta.com/) to search and manage users, update profiles, reset passwords or MFA factors, clear sessions, and manage groups and group rules. The actions also inspect or change application assignments and admin roles and query the System Log.

Choose an account and API token with the permissions required for the selected action. User lifecycle and access changes affect real accounts; confirm the target user or group before executing them.

{/* MANUAL-CONTENT-END */}

## Use the block [#usage-instructions]

Manage users, groups, and group rules. Run service desk actions like resetting MFA factors and clearing sessions. Review and change application assignments and admin roles. Query the System Log to audit sign-ins and admin changes.

## Actions [#actions]

### List Users from Okta [#list-users-from-okta]

List users in your Okta organization with optional search and filtering. Users with a DEPROVISIONED status are omitted unless a search or filter expression selects them.

<ReferenceDetails>
  #### Input [#input]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `search` | string | No | Okta search expression (e.g., profile.firstName eq "John" or profile.email co "example.com") |
  | `filter` | string | No | Okta filter expression (e.g., status eq "ACTIVE") |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of users to return per page (default: 200) |

  #### Output [#output]

  | Parameter | Type | Description |
  | - | - | - |
  | `users` | array | Array of Okta user objects |
  | ↳ `id` | string | User ID |
  | ↳ `status` | string | User status (ACTIVE, STAGED, PROVISIONED, etc.) |
  | ↳ `firstName` | string | First name |
  | ↳ `lastName` | string | Last name |
  | ↳ `email` | string | Email address |
  | ↳ `login` | string | Login (usually email) |
  | ↳ `mobilePhone` | string | Mobile phone |
  | ↳ `title` | string | Job title |
  | ↳ `department` | string | Department |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `lastLogin` | string | Last login timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `activated` | string | Activation timestamp |
  | ↳ `statusChanged` | string | Status change timestamp |
  | `count` | number | Number of users returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more users are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get User from Okta [#get-user-from-okta]

Get a specific user by ID or login from your Okta organization

<ReferenceDetails>
  #### Input [#input-1]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login (email) to look up |

  #### Output [#output-1]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | User ID |
  | `status` | string | User status |
  | `firstName` | string | First name |
  | `lastName` | string | Last name |
  | `email` | string | Email address |
  | `login` | string | Login (usually email) |
  | `mobilePhone` | string | Mobile phone |
  | `secondEmail` | string | Secondary email |
  | `displayName` | string | Display name |
  | `title` | string | Job title |
  | `department` | string | Department |
  | `organization` | string | Organization |
  | `manager` | string | Manager name |
  | `managerId` | string | Manager ID |
  | `division` | string | Division |
  | `employeeNumber` | string | Employee number |
  | `userType` | string | User type |
  | `created` | string | Creation timestamp |
  | `activated` | string | Activation timestamp |
  | `lastLogin` | string | Last login timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `statusChanged` | string | Status change timestamp |
  | `passwordChanged` | string | Password change timestamp |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Create User in Okta [#create-user-in-okta]

Create a new user in your Okta organization

<ReferenceDetails>
  #### Input [#input-2]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `firstName` | string | Yes | First name of the user |
  | `lastName` | string | Yes | Last name of the user |
  | `email` | string | Yes | Email address of the user |
  | `login` | string | No | Login for the user (defaults to email if not provided) |
  | `password` | string | No | Password for the user (if not set, user will be emailed to set password) |
  | `mobilePhone` | string | No | Mobile phone number |
  | `title` | string | No | Job title |
  | `department` | string | No | Department |
  | `activate` | boolean | No | Whether to activate the user immediately (default: true) |

  #### Output [#output-2]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Created user ID |
  | `status` | string | User status |
  | `firstName` | string | First name |
  | `lastName` | string | Last name |
  | `email` | string | Email address |
  | `login` | string | Login |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Update User in Okta [#update-user-in-okta]

Update a user profile in your Okta organization

<ReferenceDetails>
  #### Input [#input-3]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login to update |
  | `firstName` | string | No | Updated first name |
  | `lastName` | string | No | Updated last name |
  | `email` | string | No | Updated email address |
  | `login` | string | No | Updated login |
  | `mobilePhone` | string | No | Updated mobile phone number |
  | `title` | string | No | Updated job title |
  | `department` | string | No | Updated department |

  #### Output [#output-3]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | User ID |
  | `status` | string | User status |
  | `firstName` | string | First name |
  | `lastName` | string | Last name |
  | `email` | string | Email address |
  | `login` | string | Login |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Activate User in Okta [#activate-user-in-okta]

Activate a user in your Okta organization. Can only be performed on users with STAGED or DEPROVISIONED status. Optionally sends an activation email.

<ReferenceDetails>
  #### Input [#input-4]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login to activate |
  | `sendEmail` | boolean | No | Send activation email to the user (default: true) |

  #### Output [#output-4]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | Activated user ID |
  | `activated` | boolean | Whether the user was activated |
  | `activationUrl` | string | Activation URL (only returned when sendEmail is false) |
  | `activationToken` | string | Activation token (only returned when sendEmail is false) |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Deactivate User in Okta [#deactivate-user-in-okta]

Deactivate a user in your Okta organization. This transitions the user to DEPROVISIONED status.

<ReferenceDetails>
  #### Input [#input-5]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login to deactivate |
  | `sendEmail` | boolean | No | Send deactivation email to admin (default: false) |

  #### Output [#output-5]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | Deactivated user ID |
  | `deactivated` | boolean | Whether the user was deactivated |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Suspend User in Okta [#suspend-user-in-okta]

Suspend a user in your Okta organization. Only users with ACTIVE status can be suspended. Suspended users cannot log in but retain group and app assignments.

<ReferenceDetails>
  #### Input [#input-6]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login to suspend |

  #### Output [#output-6]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | Suspended user ID |
  | `suspended` | boolean | Whether the user was suspended |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Unsuspend User in Okta [#unsuspend-user-in-okta]

Unsuspend a previously suspended user in your Okta organization. Returns the user to ACTIVE status.

<ReferenceDetails>
  #### Input [#input-7]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login to unsuspend |

  #### Output [#output-7]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | Unsuspended user ID |
  | `unsuspended` | boolean | Whether the user was unsuspended |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Reset Password in Okta [#reset-password-in-okta]

Generate a one-time token to reset a user password. Can email the reset link to the user or return it directly. Transitions the user to RECOVERY status.

<ReferenceDetails>
  #### Input [#input-8]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login to reset password for |
  | `sendEmail` | boolean | No | Send password reset email to the user. Okta requires this parameter and declares no default of its own; leaving it blank sends the email |

  #### Output [#output-8]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | User ID |
  | `resetPasswordUrl` | string | Password reset URL (only returned when sendEmail is false) |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Delete User from Okta [#delete-user-from-okta]

Permanently delete a user from your Okta organization. Can only be performed on DEPROVISIONED users. If the user is active, this will first deactivate them and a second call is needed to delete.

<ReferenceDetails>
  #### Input [#input-9]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login (email) to delete |
  | `sendEmail` | boolean | No | Send deactivation email to admin (default: false) |

  #### Output [#output-9]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | Deleted user ID |
  | `deleted` | boolean | Whether the delete request was accepted. An ACTIVE user is deactivated by the first call and needs a second call to actually be deleted. |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Groups from Okta [#list-groups-from-okta]

List all groups in your Okta organization with optional search and filtering

<ReferenceDetails>
  #### Input [#input-10]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `search` | string | No | Okta search expression for groups (e.g., profile.name sw "Engineering" or type eq "OKTA\_GROUP") |
  | `filter` | string | No | Okta filter expression (e.g., type eq "OKTA\_GROUP") |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of groups to return per page (max: 10000) |

  #### Output [#output-10]

  | Parameter | Type | Description |
  | - | - | - |
  | `groups` | array | Array of Okta group objects |
  | ↳ `id` | string | Group ID |
  | ↳ `name` | string | Group name |
  | ↳ `description` | string | Group description |
  | ↳ `type` | string | Group type (OKTA\_GROUP, APP\_GROUP, BUILT\_IN) |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `lastMembershipUpdated` | string | Last membership change timestamp |
  | `count` | number | Number of groups returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more groups are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get Group from Okta [#get-group-from-okta]

Get a specific group by ID from your Okta organization

<ReferenceDetails>
  #### Input [#input-11]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupId` | string | Yes | Group ID to look up |

  #### Output [#output-11]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Group ID |
  | `name` | string | Group name |
  | `description` | string | Group description |
  | `type` | string | Group type |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `lastMembershipUpdated` | string | Last membership change timestamp |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Create Group in Okta [#create-group-in-okta]

Create a new group in your Okta organization

<ReferenceDetails>
  #### Input [#input-12]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `name` | string | Yes | Name of the group |
  | `description` | string | No | Description of the group |

  #### Output [#output-12]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Created group ID |
  | `name` | string | Group name |
  | `description` | string | Group description |
  | `type` | string | Group type |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `lastMembershipUpdated` | string | Last membership change timestamp |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Update Group in Okta [#update-group-in-okta]

Update a group profile in your Okta organization. Only groups of OKTA\_GROUP type can be updated. Fields left blank keep their stored value.

<ReferenceDetails>
  #### Input [#input-13]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupId` | string | Yes | Group ID to update |
  | `name` | string | No | Updated group name. Leave blank to keep the stored name |
  | `description` | string | No | Updated group description |

  #### Output [#output-13]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Group ID |
  | `name` | string | Group name |
  | `description` | string | Group description |
  | `type` | string | Group type |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `lastMembershipUpdated` | string | Last membership change timestamp |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Delete Group from Okta [#delete-group-from-okta]

Delete a group from your Okta organization. Groups of OKTA\_GROUP or APP\_GROUP type can be removed.

<ReferenceDetails>
  #### Input [#input-14]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupId` | string | Yes | Group ID to delete |

  #### Output [#output-14]

  | Parameter | Type | Description |
  | - | - | - |
  | `groupId` | string | Deleted group ID |
  | `deleted` | boolean | Whether the group was deleted |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Add User to Group in Okta [#add-user-to-group-in-okta]

Add a user to a group in your Okta organization

<ReferenceDetails>
  #### Input [#input-15]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupId` | string | Yes | Group ID to add the user to |
  | `userId` | string | Yes | User ID to add to the group |

  #### Output [#output-15]

  | Parameter | Type | Description |
  | - | - | - |
  | `groupId` | string | Group ID |
  | `userId` | string | User ID added to the group |
  | `added` | boolean | Whether the user was added |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Remove User from Group in Okta [#remove-user-from-group-in-okta]

Remove a user from a group in your Okta organization

<ReferenceDetails>
  #### Input [#input-16]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupId` | string | Yes | Group ID to remove the user from |
  | `userId` | string | Yes | User ID to remove from the group |

  #### Output [#output-16]

  | Parameter | Type | Description |
  | - | - | - |
  | `groupId` | string | Group ID |
  | `userId` | string | User ID removed from the group |
  | `removed` | boolean | Whether the user was removed |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Group Members from Okta [#list-group-members-from-okta]

List all members of a specific group in your Okta organization

<ReferenceDetails>
  #### Input [#input-17]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupId` | string | Yes | Group ID to list members for |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of members to return per page (default: 1000, but Okta recommends 200) |

  #### Output [#output-17]

  | Parameter | Type | Description |
  | - | - | - |
  | `members` | array | Array of group member user objects |
  | ↳ `id` | string | User ID |
  | ↳ `status` | string | User status |
  | ↳ `firstName` | string | First name |
  | ↳ `lastName` | string | Last name |
  | ↳ `email` | string | Email address |
  | ↳ `login` | string | Login |
  | ↳ `mobilePhone` | string | Mobile phone |
  | ↳ `title` | string | Job title |
  | ↳ `department` | string | Department |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `lastLogin` | string | Last login timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `activated` | string | Activation timestamp |
  | ↳ `statusChanged` | string | Status change timestamp |
  | `count` | number | Number of members returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more members are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Group Rules from Okta [#list-group-rules-from-okta]

List the group rules in your Okta organization. Each rule assigns users to groups automatically based on an expression over their profile, so this shows how group membership is being driven.

<ReferenceDetails>
  #### Input [#input-18]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `search` | string | No | Keyword to search group rules for |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of rules to return (default: 50, max: 200) |

  #### Output [#output-18]

  | Parameter | Type | Description |
  | - | - | - |
  | `rules` | array | Array of group rules |
  | ↳ `id` | string | Group rule ID |
  | ↳ `name` | string | Group rule name |
  | ↳ `type` | string | Rule type, always group\_rule |
  | ↳ `status` | string | Rule status (ACTIVE, INACTIVE, INVALID) |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `expression` | string | Okta expression that decides which users the rule matches |
  | ↳ `expressionType` | string | Expression language, typically urn:okta:expression:1.0 |
  | ↳ `assignUserToGroupIds` | array | Groups that matching users are assigned to |
  | ↳ `excludedUserIds` | array | Users excluded from the rule |
  | ↳ `excludedGroupIds` | array | Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. |
  | `count` | number | Number of rules returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more rules are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get Group Rule from Okta [#get-group-rule-from-okta]

Retrieve a single Okta group rule by ID, including the expression that decides which users it matches and the groups those users are assigned to.

<ReferenceDetails>
  #### Input [#input-19]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupRuleId` | string | Yes | Group rule ID to look up |

  #### Output [#output-19]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Group rule ID |
  | `name` | string | Group rule name |
  | `type` | string | Rule type, always group\_rule |
  | `status` | string | Rule status (ACTIVE, INACTIVE, INVALID) |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `expression` | string | Okta expression that decides which users the rule matches |
  | `expressionType` | string | Expression language, typically urn:okta:expression:1.0 |
  | `assignUserToGroupIds` | array | Groups that matching users are assigned to |
  | `excludedUserIds` | array | Users excluded from the rule |
  | `excludedGroupIds` | array | Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Create Group Rule in Okta [#create-group-rule-in-okta]

Create a group rule that automatically assigns users matching an Okta expression to one or more groups. New rules are created INACTIVE, so run Activate Group Rule afterwards to start applying it.

<ReferenceDetails>
  #### Input [#input-20]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `ruleName` | string | Yes | Name for the group rule (maximum 50 characters) |
  | `expression` | string | Yes | Okta expression that must evaluate to a boolean (e.g., user.department=="Engineering") |
  | `assignUserToGroupIds` | string | Yes | Comma-separated group IDs that matching users are assigned to |
  | `excludedUserIds` | string | No | Comma-separated user IDs to exclude from the rule |

  #### Output [#output-20]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Created group rule ID |
  | `name` | string | Group rule name |
  | `type` | string | Rule type, always group\_rule |
  | `status` | string | Rule status, which is INACTIVE for a newly created rule |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `expression` | string | Okta expression that decides which users the rule matches |
  | `expressionType` | string | Expression language, typically urn:okta:expression:1.0 |
  | `assignUserToGroupIds` | array | Groups that matching users are assigned to |
  | `excludedUserIds` | array | Users excluded from the rule |
  | `excludedGroupIds` | array | Groups excluded from the rule. Always empty — Okta does not currently support group exclusions. |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Activate Group Rule in Okta [#activate-group-rule-in-okta]

Activate a group rule so Okta starts applying it, assigning every matching user to the target groups.

<ReferenceDetails>
  #### Input [#input-21]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupRuleId` | string | Yes | Group rule ID to activate |

  #### Output [#output-21]

  | Parameter | Type | Description |
  | - | - | - |
  | `groupRuleId` | string | Activated group rule ID |
  | `activated` | boolean | Whether the rule was activated |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Deactivate Group Rule in Okta [#deactivate-group-rule-in-okta]

Deactivate a group rule so Okta stops applying it. Existing memberships the rule created are left in place. A rule must be INACTIVE before it can be edited.

<ReferenceDetails>
  #### Input [#input-22]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupRuleId` | string | Yes | Group rule ID to deactivate |

  #### Output [#output-22]

  | Parameter | Type | Description |
  | - | - | - |
  | `groupRuleId` | string | Deactivated group rule ID |
  | `deactivated` | boolean | Whether the rule was deactivated |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Delete Group Rule in Okta [#delete-group-rule-in-okta]

Permanently delete a group rule. Destructive and irreversible. Optionally also removes the users that this rule had assigned from those groups, which revokes any access those groups grant.

<ReferenceDetails>
  #### Input [#input-23]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `groupRuleId` | string | Yes | Group rule ID to delete |
  | `removeUsers` | boolean | No | Also remove the users this rule assigned from the groups it targeted (default: false) |

  #### Output [#output-23]

  | Parameter | Type | Description |
  | - | - | - |
  | `groupRuleId` | string | Deleted group rule ID |
  | `deleted` | boolean | Whether the deletion was accepted. Okta answers 202 and removes the rule asynchronously. |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Factors from Okta [#list-factors-from-okta]

List the MFA factors a user has enrolled, with each factor type, provider, and enrollment status. Use this before resetting a factor to confirm which one to target.

<ReferenceDetails>
  #### Input [#input-24]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) to list enrolled factors for |

  #### Output [#output-24]

  | Parameter | Type | Description |
  | - | - | - |
  | `factors` | array | Array of enrolled MFA factors |
  | ↳ `id` | string | Factor ID |
  | ↳ `factorType` | string | Factor type (sms, call, email, push, question, token:software:totp, webauthn, etc.) |
  | ↳ `provider` | string | Factor provider (OKTA, GOOGLE, FIDO, DUO, RSA, SYMANTEC, YUBICO, CUSTOM) |
  | ↳ `vendorName` | string | Factor vendor name |
  | ↳ `status` | string | Enrollment status (ACTIVE, PENDING\_ACTIVATION, NOT\_SETUP, etc.) |
  | ↳ `created` | string | Enrollment timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `profile` | json | Factor-specific attributes, which vary by factor type (phone number, email, question, credential ID) |
  | `count` | number | Number of enrolled factors |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get Factor from Okta [#get-factor-from-okta]

Retrieve a single enrolled MFA factor for a user, including its type, provider, enrollment status, and factor-specific profile.

<ReferenceDetails>
  #### Input [#input-25]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) the factor belongs to |
  | `factorId` | string | Yes | Factor ID to look up |

  #### Output [#output-25]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Factor ID |
  | `factorType` | string | Factor type |
  | `provider` | string | Factor provider |
  | `vendorName` | string | Factor vendor name |
  | `status` | string | Enrollment status |
  | `created` | string | Enrollment timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `profile` | json | Factor-specific attributes, which vary by factor type (phone number, email, question, credential ID) |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Enroll Factor in Okta [#enroll-factor-in-okta]

Enroll an MFA factor for a user. The profile fields required depend on the factor type: a phone number for sms and call, an email address for email, and a question and answer for question. Factors that enroll from the user device, such as webauthn and push, need no profile fields.

<ReferenceDetails>
  #### Input [#input-26]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) to enroll the factor for |
  | `factorType` | string | Yes | Factor type to enroll (sms, call, email, question, push, token:software:totp, u2f, webauthn) |
  | `provider` | string | Yes | Factor provider (OKTA, GOOGLE, FIDO, DUO, RSA, SYMANTEC, YUBICO, CUSTOM). Each provider supports a subset of factor types |
  | `phoneNumber` | string | No | Phone number in E.164 format. Required for the sms and call factor types |
  | `factorEmail` | string | No | Email address to enroll. Required for the email factor type |
  | `securityQuestion` | string | No | Security question key (e.g., disliked\_food). Required for the question factor type |
  | `securityAnswer` | string | No | Answer to the security question, minimum 4 characters. Required for the question factor type |
  | `activate` | boolean | No | Activate the factor immediately as part of enrollment. Supported by the sms, call, email, and token:hotp factor types (default: false) |

  #### Output [#output-26]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Enrolled factor ID |
  | `factorType` | string | Factor type |
  | `provider` | string | Factor provider |
  | `vendorName` | string | Factor vendor name |
  | `status` | string | Enrollment status, typically PENDING\_ACTIVATION until the user activates it |
  | `created` | string | Enrollment timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `profile` | json | Factor-specific attributes, which vary by factor type (phone number, email, question, credential ID) |
  | `enrolled` | boolean | Whether the factor was enrolled |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Reset Factor in Okta [#reset-factor-in-okta]

Unenroll one specific MFA factor for a user so they can re-enroll it. Destructive and irreversible: the existing enrollment is removed. Unenrolling a push or signed\_nonce factor also unenrolls the related Okta Verify factors. Factors cannot be unenrolled from a deactivated user.

<ReferenceDetails>
  #### Input [#input-27]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) the factor belongs to |
  | `factorId` | string | Yes | Factor ID to unenroll |
  | `removeRecoveryEnrollment` | boolean | No | Also remove the phone number as a recovery method, not only as a factor. Applies to sms and call factors only (default: false) |

  #### Output [#output-27]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | User the factor belonged to |
  | `factorId` | string | Unenrolled factor ID |
  | `reset` | boolean | Whether the factor was unenrolled |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Reset All Factors in Okta [#reset-all-factors-in-okta]

Reset every MFA factor for a user, returning all enrollments to the unenrolled state. Destructive and irreversible: the user must re-enroll each factor before they can complete MFA again. The user status stays ACTIVE.

<ReferenceDetails>
  #### Input [#input-28]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | User ID or login whose MFA factors will all be reset |

  #### Output [#output-28]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | User whose factors were reset |
  | `reset` | boolean | Whether all factors were reset |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Clear User Sessions in Okta [#clear-user-sessions-in-okta]

Revoke every active Okta session for a user, signing them out of all devices immediately. Destructive and irreversible: the user must sign in again. Optionally also revokes their OAuth and OpenID Connect tokens, and clears remembered factors.

<ReferenceDetails>
  #### Input [#input-29]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) whose sessions will be revoked |
  | `oauthTokens` | boolean | No | Also revoke the user OpenID Connect and OAuth refresh and access tokens (default: false) |
  | `forgetDevices` | boolean | No | Clear the user remembered factors for all devices (default: true) |

  #### Output [#output-29]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | User whose sessions were revoked |
  | `cleared` | boolean | Whether the sessions were revoked |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get Session from Okta [#get-session-from-okta]

Retrieve an Okta session by ID, including who it belongs to, when it expires, and which authentication methods were used to establish it.

<ReferenceDetails>
  #### Input [#input-30]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `sessionId` | string | Yes | Session ID to look up |

  #### Output [#output-30]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Session ID |
  | `login` | string | Login of the session user |
  | `userId` | string | ID of the session user |
  | `status` | string | Session status (ACTIVE, MFA\_ENROLL, MFA\_REQUIRED) |
  | `createdAt` | string | Session creation timestamp |
  | `expiresAt` | string | Session expiry timestamp |
  | `lastPasswordVerification` | string | Timestamp of the last password verification |
  | `lastFactorVerification` | string | Timestamp of the last factor verification |
  | `amr` | array | Authentication methods used to establish the session |
  | `idpId` | string | Identity provider ID |
  | `idpType` | string | Identity provider type |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Revoke Session in Okta [#revoke-session-in-okta]

Revoke a single Okta session by ID, ending that sign-in immediately. Destructive and irreversible: the affected user must sign in again on that device.

<ReferenceDetails>
  #### Input [#input-31]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `sessionId` | string | Yes | Session ID to revoke |

  #### Output [#output-31]

  | Parameter | Type | Description |
  | - | - | - |
  | `sessionId` | string | Revoked session ID |
  | `revoked` | boolean | Whether the session was revoked |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Applications from Okta [#list-applications-from-okta]

List the applications configured in your Okta organization, with optional name search, filtering, and cursor pagination.

<ReferenceDetails>
  #### Input [#input-32]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `q` | string | No | Search for applications whose name or label starts with this value |
  | `filter` | string | No | Okta filter expression (e.g., status eq "ACTIVE") |
  | `includeNonDeleted` | boolean | No | Also return inactive applications. Deleted applications stay excluded either way (default: false) |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of applications to return (max: 200) |

  #### Output [#output-32]

  | Parameter | Type | Description |
  | - | - | - |
  | `apps` | array | Array of Okta applications |
  | ↳ `id` | string | Application ID |
  | ↳ `name` | string | Application name (the app template key) |
  | ↳ `label` | string | Application display label |
  | ↳ `status` | string | Application status (ACTIVE, INACTIVE, DELETED) |
  | ↳ `signOnMode` | string | Sign-on mode (SAML\_2\_0, OPENID\_CONNECT, BOOKMARK, etc.) |
  | ↳ `features` | array | Enabled provisioning features |
  | ↳ `created` | string | Creation timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | `count` | number | Number of applications returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more applications are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get Application from Okta [#get-application-from-okta]

Retrieve a single Okta application by ID, including its sign-on mode, status, enabled provisioning features, and configuration objects.

<ReferenceDetails>
  #### Input [#input-33]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to look up |

  #### Output [#output-33]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Application ID |
  | `name` | string | Application name (the app template key) |
  | `label` | string | Application display label |
  | `status` | string | Application status (ACTIVE, INACTIVE, DELETED) |
  | `signOnMode` | string | Sign-on mode |
  | `features` | array | Enabled provisioning features |
  | `created` | string | Creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `accessibility` | json | Access settings for the app |
  | ↳ `errorRedirectUrl` | string | Custom error page URL |
  | ↳ `loginRedirectUrl` | string | Custom login page URL |
  | ↳ `selfService` | boolean | Whether users can self-assign the app |
  | `visibility` | json | Visibility settings for the app |
  | ↳ `appLinks` | json | Map of app link name to whether it appears on the End-User Dashboard |
  | ↳ `autoLaunch` | boolean | Signs in to the app automatically when the user signs in to Okta |
  | ↳ `autoSubmitToolbar` | boolean | Signs in automatically when the user lands on the sign-in page |
  | ↳ `hide` | json | Which end-user apps hide this app |
  | ↳ `iOS` | boolean | Hidden in Okta Mobile |
  | ↳ `web` | boolean | Hidden on the Okta End-User Dashboard |
  | `settings` | json | Application settings. Okta types these per app kind, so settings.app differs between a SAML, OIDC, bookmark, or SWA app |
  | `profile` | json | Application profile attributes. Okta accepts any valid JSON schema here, so the shape is whatever the org configured |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Application Users from Okta [#list-application-users-from-okta]

List the users assigned to an Okta application, including how each assignment was made and its provisioning sync state. Use this to audit who has access to an app.

<ReferenceDetails>
  #### Input [#input-34]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to list assigned users for |
  | `q` | string | No | Search assigned users whose userName, firstName, lastName, or email starts with this value |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of assigned users to return (default: 50, max: 500) |

  #### Output [#output-34]

  | Parameter | Type | Description |
  | - | - | - |
  | `appUsers` | array | Array of application user assignments |
  | ↳ `id` | string | Okta user ID |
  | ↳ `externalId` | string | ID of the user in the downstream application |
  | ↳ `created` | string | Assignment creation timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `scope` | string | How the assignment was made: USER (direct) or GROUP (inherited) |
  | ↳ `status` | string | Assignment status |
  | ↳ `statusChanged` | string | Status change timestamp |
  | ↳ `passwordChanged` | string | App password change timestamp |
  | ↳ `syncState` | string | Provisioning sync state |
  | ↳ `lastSync` | string | Last provisioning sync |
  | ↳ `userName` | string | Username the user signs in to the application with |
  | ↳ `profile` | json | App-specific profile attributes, whose shape is set by the app schema |
  | `count` | number | Number of assignments returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more assignments are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Assign User to Application in Okta [#assign-user-to-application-in-okta]

Assign a user to an Okta application, granting them access to it. Applications that require credentials also need the username the user signs in with.

<ReferenceDetails>
  #### Input [#input-35]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to assign the user to |
  | `userId` | string | Yes | Okta user ID to assign |
  | `scope` | string | No | Assignment scope: USER for a direct assignment, or GROUP |
  | `appUserName` | string | No | Username the user signs in to the application with. Required by applications that store credentials |

  #### Output [#output-35]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Okta user ID that was assigned |
  | `externalId` | string | ID of the user in the downstream application |
  | `created` | string | Assignment creation timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `scope` | string | Assignment scope (USER or GROUP) |
  | `status` | string | Assignment status |
  | `statusChanged` | string | Status change timestamp |
  | `passwordChanged` | string | App password change timestamp |
  | `syncState` | string | Provisioning sync state |
  | `lastSync` | string | Last provisioning sync |
  | `userName` | string | Username the user signs in to the application with |
  | `profile` | json | App-specific profile attributes, whose shape is set by the app schema |
  | `assigned` | boolean | Whether the user was assigned |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Remove User from Application in Okta [#remove-user-from-application-in-okta]

Unassign a user from an Okta application, revoking their access. Destructive and irreversible: the app profile for that user is permanently removed, and if provisioning is enabled the downstream account is deactivated.

<ReferenceDetails>
  #### Input [#input-36]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to remove the user from |
  | `userId` | string | Yes | Okta user ID to unassign |
  | `sendEmail` | boolean | No | Send a deactivation email to the administrator (default: false) |

  #### Output [#output-36]

  | Parameter | Type | Description |
  | - | - | - |
  | `appId` | string | Application ID |
  | `userId` | string | User unassigned from the application |
  | `removed` | boolean | Whether the user was unassigned |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List Application Groups from Okta [#list-application-groups-from-okta]

List the groups assigned to an Okta application. Every member of an assigned group inherits access to the app, so this is the starting point for an app access review.

<ReferenceDetails>
  #### Input [#input-37]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to list assigned groups for |
  | `q` | string | No | Search assigned groups whose name starts with this value |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of assigned groups to return (default: 20, range: 20 to 200) |

  #### Output [#output-37]

  | Parameter | Type | Description |
  | - | - | - |
  | `appGroups` | array | Array of application group assignments |
  | ↳ `id` | string | Assigned group ID |
  | ↳ `priority` | number | Assignment priority, which resolves conflicting profile mappings |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `profile` | json | App-specific profile attributes, whose shape is set by the app schema |
  | `count` | number | Number of assignments returned |
  | `nextCursor` | string | Cursor for the next page, or null on the last page |
  | `hasMore` | boolean | Whether more assignments are available |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Assign Group to Application in Okta [#assign-group-to-application-in-okta]

Assign a group to an Okta application so every member of the group inherits access to it.

<ReferenceDetails>
  #### Input [#input-38]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to assign the group to |
  | `groupId` | string | Yes | Group ID to assign |
  | `priority` | number | No | Assignment priority, which resolves conflicting profile mappings when a user belongs to several assigned groups |

  #### Output [#output-38]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Assigned group ID |
  | `priority` | number | Assignment priority |
  | `lastUpdated` | string | Last update timestamp |
  | `profile` | json | App-specific profile attributes, whose shape is set by the app schema |
  | `assigned` | boolean | Whether the group was assigned |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Remove Group from Application in Okta [#remove-group-from-application-in-okta]

Unassign a group from an Okta application. Destructive: every member who had access only through this group loses access to the app.

<ReferenceDetails>
  #### Input [#input-39]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `appId` | string | Yes | Application ID to remove the group from |
  | `groupId` | string | Yes | Group ID to unassign |

  #### Output [#output-39]

  | Parameter | Type | Description |
  | - | - | - |
  | `appId` | string | Application ID |
  | `groupId` | string | Group unassigned from the application |
  | `removed` | boolean | Whether the group was unassigned |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### List User Roles from Okta [#list-user-roles-from-okta]

List the administrator roles assigned to a user. Returns both standard roles and custom role bindings, so you can review who holds privileged access.

<ReferenceDetails>
  #### Input [#input-40]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) to list admin roles for |

  #### Output [#output-40]

  | Parameter | Type | Description |
  | - | - | - |
  | `roles` | array | Array of admin role assignments |
  | ↳ `id` | string | Role assignment ID, which is the resource set binding ID for a custom role. Pass this to Remove User Role |
  | ↳ `label` | string | Role label |
  | ↳ `type` | string | Role type (SUPER\_ADMIN, ORG\_ADMIN, APP\_ADMIN, USER\_ADMIN, HELP\_DESK\_ADMIN, READ\_ONLY\_ADMIN, CUSTOM, etc.) |
  | ↳ `status` | string | Role status (ACTIVE, INACTIVE) |
  | ↳ `created` | string | Assignment timestamp |
  | ↳ `lastUpdated` | string | Last update timestamp |
  | ↳ `assignmentType` | string | How the role was assigned (USER, GROUP, CLIENT) |
  | ↳ `role` | string | Custom role ID, present only on custom role assignments |
  | ↳ `resourceSet` | string | Resource set ID, present only on custom role assignments |
  | `count` | number | Number of role assignments returned |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Assign User Role in Okta [#assign-user-role-in-okta]

Grant a user an administrator role. Use a standard role type such as USER\_ADMIN or HELP\_DESK\_ADMIN, or CUSTOM together with a custom role ID and a resource set ID. This grants privileged access, so confirm the role is the least privilege that fits.

<ReferenceDetails>
  #### Input [#input-41]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) to assign the admin role to |
  | `roleType` | string | Yes | Role type to assign: SUPER\_ADMIN, ORG\_ADMIN, APP\_ADMIN, USER\_ADMIN, HELP\_DESK\_ADMIN, READ\_ONLY\_ADMIN, API\_ACCESS\_MANAGEMENT\_ADMIN, GROUP\_MEMBERSHIP\_ADMIN, REPORT\_ADMIN, WORKFLOWS\_ADMIN, ACCESS\_CERTIFICATIONS\_ADMIN, ACCESS\_REQUESTS\_ADMIN, or CUSTOM |
  | `customRoleId` | string | No | Custom role ID. Required when the role type is CUSTOM |
  | `resourceSetId` | string | No | Resource set ID the custom role applies to. Required when the role type is CUSTOM |
  | `disableNotifications` | boolean | No | Grant the user third-party admin status, which suppresses Okta admin notifications (default: false) |

  #### Output [#output-41]

  | Parameter | Type | Description |
  | - | - | - |
  | `id` | string | Role assignment ID, which is what Remove User Role takes |
  | `label` | string | Role label |
  | `type` | string | Assigned role type |
  | `status` | string | Role status |
  | `created` | string | Assignment timestamp |
  | `lastUpdated` | string | Last update timestamp |
  | `assignmentType` | string | How the role was assigned (USER, GROUP, CLIENT) |
  | `role` | string | Custom role ID, for custom roles |
  | `resourceSet` | string | Resource set ID, for custom roles |
  | `assigned` | boolean | Whether the role was assigned |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Remove User Role in Okta [#remove-user-role-in-okta]

Revoke an administrator role from a user. Destructive: the user immediately loses the admin permissions that role granted. Takes the role assignment ID, not the role type, which List User Roles returns as the role id field.

<ReferenceDetails>
  #### Input [#input-42]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `userId` | string | Yes | Okta user ID (not a login or email) to revoke the admin role from |
  | `roleAssignmentId` | string | Yes | Role assignment ID to revoke, as returned by List User Roles. For a custom role this is the resource set binding ID |

  #### Output [#output-42]

  | Parameter | Type | Description |
  | - | - | - |
  | `userId` | string | User the role was revoked from |
  | `roleAssignmentId` | string | Revoked role assignment ID |
  | `removed` | boolean | Whether the role was revoked |
  | `success` | boolean | Operation success status |
</ReferenceDetails>

### Get System Log Events from Okta [#get-system-log-events-from-okta]

Query the Okta System Log for sign-ins, admin changes, and security events. Supports a time window, SCIM filter expressions, keyword search, and cursor pagination for audit and investigation workflows.

<ReferenceDetails>
  #### Input [#input-43]

  | Parameter | Type | Required | Description |
  | - | - | - | - |
  | `apiKey` | string | Yes | Okta API token for authentication |
  | `domain` | string | Yes | Okta domain (e.g., dev-123456.okta.com) |
  | `since` | string | No | Start of the query time window as an ISO 8601 timestamp (default: 7 days before "until"). Ignored when a cursor is supplied in "after", which already encodes the resume position |
  | `until` | string | No | End of the query time window as an ISO 8601 timestamp (default: now) |
  | `filter` | string | No | SCIM filter expression (e.g., eventType eq "user.session.start" or outcome.result eq "FAILURE") |
  | `q` | string | No | Keyword search across the event payload (max 40 characters per keyword, max 10 keywords) |
  | `sortOrder` | string | No | Sort order: ASCENDING (default) or DESCENDING |
  | `after` | string | No | Opaque pagination cursor returned as nextCursor by a previous call |
  | `limit` | number | No | Maximum number of events to return (default: 100, max: 1000) |

  #### Output [#output-43]

  | Parameter | Type | Description |
  | - | - | - |
  | `events` | array | Array of System Log events |
  | ↳ `uuid` | string | Unique event ID |
  | ↳ `published` | string | Event timestamp |
  | ↳ `eventType` | string | Event type (e.g., user.session.start, user.account.update\_password) |
  | ↳ `severity` | string | Event severity (DEBUG, ERROR, INFO, WARN) |
  | ↳ `legacyEventType` | string | Legacy event type |
  | ↳ `displayMessage` | string | Human-readable event description |
  | ↳ `outcomeResult` | string | Event outcome (SUCCESS, FAILURE, CHALLENGE, DENY, etc.) |
  | ↳ `outcomeReason` | string | Reason for the outcome |
  | ↳ `actorId` | string | ID of the actor |
  | ↳ `actorType` | string | Actor type (User, Client, etc.) |
  | ↳ `actorAlternateId` | string | Actor alternate ID, usually the login |
  | ↳ `actorDisplayName` | string | Actor display name |
  | ↳ `clientIpAddress` | string | Client IP address |
  | ↳ `clientDevice` | string | Client device category (e.g., Computer) |
  | ↳ `clientZone` | string | Network zone |
  | ↳ `clientBrowser` | string | Client browser |
  | ↳ `clientOs` | string | Client operating system |
  | ↳ `clientCity` | string | Client city |
  | ↳ `clientState` | string | Client state or region |
  | ↳ `clientCountry` | string | Client country |
  | ↳ `authenticationProvider` | string | Authentication provider used |
  | ↳ `credentialType` | string | Credential type used |
  | ↳ `externalSessionId` | string | External session ID for correlating events |
  | ↳ `securityAsOrg` | string | Autonomous system organization |
  | ↳ `securityIsp` | string | Internet service provider |
  | ↳ `securityIsProxy` | boolean | Whether the request came through a proxy |
  | ↳ `transactionId` | string | Transaction ID |
  | ↳ `transactionType` | string | Transaction type (e.g., WEB, JOB) |
  | ↳ `targets` | array | Entities the event acted upon |
  | ↳ `id` | string | Target ID |
  | ↳ `type` | string | Target type |
  | ↳ `alternateId` | string | Target alternate ID |
  | ↳ `displayName` | string | Target display name |
  | ↳ `debugData` | json | Extra context whose keys depend on the event type. Okta states these keys and values can change between releases, so treat them as a debugging aid rather than a contract |
  | `count` | number | Number of events returned |
  | `nextCursor` | string | Cursor to resume from, or null when Okta advertised no next link. On a polling query it stays set on an empty page so the next scheduled run resumes from here rather than replaying from the start |
  | `hasMore` | boolean | Whether more events are available. A query with no "until" is a polling query, which Okta always answers with a next link even when there are no new events, so this reports false once a page comes back empty |
  | `success` | boolean | Operation success status |
</ReferenceDetails>