Okta

Lists all applications in your Okta org with pagination, filtering, and search

Retrieves a specific application by ID from your Okta org. Use list_applications to obtain the appId.

Lists all group assignments for an application. Use list_applications to obtain the appId.

Retrieves a specific group assignment for an application. Use list_applications and list_application_groups to obtain re…

Lists all users assigned to an application. Use list_applications to obtain the appId.

Retrieves a specific user assigned to an application. Use list_applications and list_application_users to obtain require…

Assigns a user to an application directly

Removes a user’s assignment to an application

Assigns a group to an application, granting access to its members

Removes a group’s assignment to an application

Activates an inactive application

Deactivates an active application and reconciles its group assignments

Lists all device assurance policies in the org

Retrieves a single device assurance policy by ID

Lists the authenticators configured in your org. Okta Identity Engine orgs only.

Lists the methods of an authenticator, such as sms and voice for phone. Okta Identity Engine orgs only. Use list_authent…

Lists all devices with pagination support and flexible search options

Retrieves a device by its ID

Permanently deletes a device. Device must be in DEACTIVATED status first.

Activates a device by setting its status to ACTIVE

Deactivates a device by setting its status to DEACTIVATED

Suspends a device temporarily without deactivating it

Returns a suspended device to the active state

Retrieves a single enrolled MFA factor for a user

Lists all MFA factors a user is eligible to enrol

Lists access certification campaigns in the org

Retrieves a single access certification campaign by ID

Launches a scheduled campaign and assigns reviews to reviewers

Lists access requests raised by users in the org

Retrieves a single access request by ID

Raises an access request for a resource on behalf of a user

Cancels an open access request via the provider’s Update a request operation

Lists the access request types defined in the org

Retrieves a single access request type by ID

Publishes a request type, making it available to end users

Unpublishes a request type, returning it to draft

Lists access certification reviews, optionally scoped to one campaign

Retrieves a single access certification review by ID

Reassigns a batch of reviews to a different reviewer

Lists all groups with pagination support

Retrieves a specific group by ID from your org. Use list_groups to obtain the groupId.

Lists the group rules in your org with pagination support

Retrieves a specific group rule by ID. Use list_group_rules to obtain the groupRuleId.

Adds a new group with OKTA_GROUP type to your org

Replaces the profile for a group of OKTA_GROUP type

Deletes a group of OKTA_GROUP or APP_GROUP type from your org

Lists all users that are a member of a group. Use list_groups to obtain the groupId.

Assigns a user to a group with OKTA_GROUP type. Use list_groups and list_users to obtain required IDs.

Unassigns a user from a group with OKTA_GROUP type. Use list_groups and list_group_members to obtain required IDs.

Activates a group rule so it begins assigning members

Deactivates a group rule so it stops assigning members

Lists the applications assigned to a group

Lists the owners of a group

Lists all policies of a given type

Retrieves a specific policy by ID. Use list_policies to obtain the policyId.

Creates a new policy of the specified type. The returned policy ID can be used with get_policy, replace_policy, delete_p…

Replaces a policy with the provided data. Use list_policies or create_policy to obtain the policyId.

Deletes a policy by ID

Activates a policy by setting its status to ACTIVE

Deactivates a policy by setting its status to INACTIVE

Clones an existing ACCESS_POLICY to create a copy

Simulates a policy evaluation to test access outcomes

Lists all applications mapped to an ACCESS_POLICY. Use list_policies with type ACCESS_POLICY to obtain the policyId.

Lists all resources mapped to a policy. Use list_policies to obtain the policyId.

Retrieves a specific policy resource mapping. Use list_policy_mappings to obtain the mappingId.

Lists all rules for a specific policy. Use list_policies to obtain the policyId first.

Retrieves a specific rule for a policy

Creates a new rule for a policy. Use list_policies to obtain the policyId. The created rule ID is returned in the respon…

Replaces a policy rule with the provided data. Use list_policy_rules to obtain the ruleId.

Deletes a policy rule. Use list_policy_rules to obtain the ruleId.

Activates a policy rule. Use list_policy_rules to obtain the ruleId.

Deactivates a policy rule. Use list_policy_rules to obtain the ruleId.

Lists all Realms with pagination support

Retrieves a Realm by its ID

Creates a new Realm

Replaces the realm profile by its ID

Deletes a Realm by its ID

Lists all administrator roles assigned to a user

Lists the custom admin roles in your org, plus IAM-based standard roles such as WORKFLOWS_ADMIN.

Lists every user in the org that holds an administrator role

Lists the metadata of the active API tokens in your org

Lists the event hooks configured in your org

Lists the identity provider (IdP) integrations in your org with pagination support

Lists the network zones in your org with pagination support

Lists the trusted origins in your org with pagination support

Retrieves information about the currently authenticated user from the OAuth 2.0 UserInfo endpoint.

Lists events from the Okta System Log with filtering, keyword search, and pagination

Lists all users in your org with pagination and flexible query options

Retrieves a user from your Okta org by ID, login, or shortname. Use list_users to find the user ID, or pass the user’s l…

Creates a new user in your Okta org with or without credentials

Updates a user’s profile or credentials with partial update semantics. Use list_users or get_user to obtain the user ID.

Replaces a user’s profile, credentials, or both using strict-update semantics. Use get_user first to fetch the current p…

Lists information about how a user is blocked from accessing their account. Use list_users to obtain the user ID.

Lists the MFA factors a user has enrolled. Use list_users to obtain the user ID.

Lists all authenticators a user has enrolled. Okta Identity Engine orgs only. Use list_users to obtain the user ID.

Lists the groups a user belongs to. Use list_users to obtain the user ID.

Lists the admin roles assigned to a user, including standard and custom roles. Use list_users to obtain the user ID.

Permanently deletes a user from your Okta organization. Use list_users to obtain the user ID. Requires two calls — first…

Suspends an active user, blocking sign-in without removing access

Returns a suspended user to the active state

Deactivates a user and deprovisions them from all assigned apps

Activates a staged or deprovisioned user

Restarts the activation workflow for a provisioned or recovering user

Unlocks a locked-out user so they can sign in again

Starts a password reset and moves the user into recovery

Expires a user password, forcing a change at next sign-in

Revokes a user’s active sessions, forcing re-authentication

Lists the apps a user can reach, directly or through a group

Lists the devices enrolled by a specific user

Lists all user types in your Okta organization

Retrieves a user type by ID

Creates a new user type in your Okta organization

Partially updates an existing user type

Fully replaces an existing user type

Permanently deletes a user type

Responds to Okta’s one-time verification GET by echoing the x-okta-verification-challenge header value back in the JSON…

Emitted when a new user account is created in Okta (provisioned by an admin, sourced from a directory, or self-registere…

Emitted when a user transitions from STAGED, PROVISIONED, or DEPROVISIONED to ACTIVE status and gains access. Maps to Ok…

Emitted when a user is deactivated — access is revoked and sessions are invalidated, but the account is preserved (statu…

Emitted when a user is temporarily suspended — sign-in is blocked and sessions are invalidated, but the user can be unsu…

Emitted when a user-deletion request is initiated — the user enters DELETED status. Note that `user.lifecycle.delete.con…

Emitted when a user’s password is reset (admin-initiated, self-service, or via the connector’s reset action). Maps to Ok…

Emitted when one or more user profile attributes are changed (first name, last name, email, phone, custom attributes, et…

Emitted when a Universal Logout signal terminates all of a user’s sessions and tokens across federated apps. Maps to Okt…

Emitted when a new group is created in Okta. Maps to Okta event group.lifecycle.create.

Emitted when a group is deleted from Okta. Note that there is no group.lifecycle.modify or update event — group attr…

Emitted when a user is added as a member of a group. Maps to Okta event group.user_membership.add.

Emitted when a user is removed from a group’s membership. Maps to Okta event group.user_membership.remove.

Emitted when a device transitions from STAGED to ACTIVE status and becomes trusted. Maps to Okta event `device.lifecycle…

Emitted when a device is deactivated and loses its trusted status. Maps to Okta event device.lifecycle.deactivate.

Emitted when a device is permanently removed from Okta. Maps to Okta event device.lifecycle.delete.

Emitted when a user is assigned to an application — the core “who has access to what” IAM signal. Maps to Okta event `ap…

Emitted when a user is removed from an application — deprovisioning / access-loss signal critical for downstream cleanup…

Emitted when an application sign-on policy denies a user access during sign-in. Security / compliance signal — useful fo…

Emitted when a new Okta admin API token is created. Security-critical signal — useful for audit logging, anomaly detecti…

Emitted when an Okta admin API token is revoked. Security signal — useful for tracking credential lifecycle and detectin…