openapi: 3.0.1 info: title: Okta Application User API description: Allows customers to easily access the Okta API termsOfService: https://developer.okta.com/terms/ contact: name: Okta Developer Team url: https://developer.okta.com/ email: devex-public@okta.com license: name: Apache-2.0 url: https://www.apache.org/licenses/LICENSE-2.0.html version: 2.16.0 servers: - url: https://your-subdomain.okta.com/ tags: - name: User paths: /api/v1/users: get: tags: - User summary: Okta List Users description: Lists users that do not have a status of 'DEPROVISIONED' (by default), up to the maximum (200 for most orgs), with pagination in most cases. A subset of users can be returned that match a supported filter expression or search criteria. operationId: listUsers parameters: - name: q in: query description: Finds a user that matches firstName, lastName, and email properties schema: type: string - name: after in: query description: Specifies the pagination cursor for the next page of users schema: type: string - name: limit in: query description: Specifies the number of results returned schema: type: integer format: int32 default: 10 - name: filter in: query description: Filters users with a supported expression for a subset of properties schema: type: string - name: search in: query description: Searches for users with a supported filtering expression for most properties schema: type: string - name: sortBy in: query schema: type: string - name: sortOrder in: query schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/User' security: - api_token: [] post: tags: - User summary: Okta Create User description: Creates a new user in your Okta organization with or without credentials. operationId: createUser parameters: - name: activate in: query description: Executes activation lifecycle operation when creating the user schema: type: boolean default: true - name: provider in: query description: Indicates whether to create a user with a specified authentication provider schema: type: boolean default: false - name: nextLogin in: query description: With activate=true, set nextLogin to "changePassword" to have the password be EXPIRED, so user must change it the next time they log in. schema: type: string x-okta-added-version: 0.14.0 x-openapi-v3-schema-ref: '#/definitions/UserNextLogin' x-okta-added-version: 0.14.0 x-openapi-v3-schema-ref: '#/definitions/UserNextLogin' requestBody: content: application/json: schema: $ref: '#/components/schemas/CreateUserRequest' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/User' security: - api_token: [] x-codegen-request-body-name: body /api/v1/users/{associatedUserId}/linkedObjects/{primaryRelationshipName}/{primaryUserId}: put: tags: - User operationId: setLinkedObjectForUser parameters: - name: associatedUserId in: path required: true schema: type: string - name: primaryRelationshipName in: path required: true schema: type: string - name: primaryUserId in: path required: true schema: type: string responses: '204': description: Success content: {} security: - api_token: [] /api/v1/users/{userId}: get: tags: - User summary: Okta Get User description: Fetches a user from your Okta organization. operationId: getUser parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/User' security: - api_token: [] put: tags: - User summary: Okta Update User description: Update a user's profile and/or credentials using strict-update semantics. operationId: updateUser parameters: - name: userId in: path required: true schema: type: string - name: strict in: query schema: type: boolean x-okta-added-version: 1.10.0 x-okta-added-version: 1.10.0 requestBody: content: application/json: schema: $ref: '#/components/schemas/User' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/User' security: - api_token: [] x-codegen-request-body-name: user post: tags: - User description: Update a user's profile or credentials with partial update semantics. operationId: partialUpdateUser parameters: - name: userId in: path required: true schema: type: string - name: strict in: query schema: type: boolean requestBody: content: application/json: schema: $ref: '#/components/schemas/User' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/User' security: - api_token: [] x-codegen-request-body-name: user delete: tags: - User summary: Okta Delete User description: Deletes a user permanently. This operation can only be performed on users that have a `DEPROVISIONED` status. **This action cannot be recovered!** operationId: deactivateOrDeleteUser parameters: - name: userId in: path required: true schema: type: string - name: sendEmail in: query schema: type: boolean default: false x-okta-added-version: 1.5.0 x-okta-added-version: 1.5.0 responses: '202': description: ACCEPTED content: {} security: - api_token: [] /api/v1/users/{userId}/appLinks: get: tags: - User summary: Okta Get Assigned App Links description: Fetches appLinks for all direct or indirect (via group membership) assigned applications. operationId: listAppLinks parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/AppLink' security: - api_token: [] /api/v1/users/{userId}/clients: get: tags: - User description: Lists all client resources for which the specified user has grants or tokens. operationId: listUserClients parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/OAuth2Client' security: - api_token: [] /api/v1/users/{userId}/clients/{clientId}/grants: get: tags: - User description: Lists all grants for a specified user and client operationId: listGrantsForUserAndClient parameters: - name: userId in: path required: true schema: type: string - name: clientId in: path required: true schema: type: string - name: expand in: query schema: type: string - name: after in: query schema: type: string - name: limit in: query schema: type: integer format: int32 default: 20 responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/OAuth2ScopeConsentGrant' security: - api_token: [] delete: tags: - User description: Revokes all grants for the specified user and client operationId: revokeGrantsForUserAndClient parameters: - name: userId in: path required: true schema: type: string - name: clientId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/clients/{clientId}/tokens: get: tags: - User description: Lists all refresh tokens issued for the specified User and Client. operationId: listRefreshTokensForUserAndClient parameters: - name: userId in: path required: true schema: type: string - name: clientId in: path required: true schema: type: string - name: expand in: query schema: type: string - name: after in: query schema: type: string - name: limit in: query schema: type: integer format: int32 default: 20 responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/OAuth2RefreshToken' security: - api_token: [] delete: tags: - User description: Revokes all refresh tokens issued for the specified User and Client. operationId: revokeTokensForUserAndClient parameters: - name: userId in: path required: true schema: type: string - name: clientId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/clients/{clientId}/tokens/{tokenId}: get: tags: - User description: Gets a refresh token issued for the specified User and Client. operationId: getRefreshTokenForUserAndClient parameters: - name: userId in: path required: true schema: type: string - name: clientId in: path required: true schema: type: string - name: tokenId in: path required: true schema: type: string - name: expand in: query schema: type: string - name: limit in: query schema: type: integer default: 20 - name: after in: query schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/OAuth2RefreshToken' security: - api_token: [] delete: tags: - User description: Revokes the specified refresh token. operationId: revokeTokenForUserAndClient parameters: - name: userId in: path required: true schema: type: string - name: clientId in: path required: true schema: type: string - name: tokenId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/credentials/change_password: post: tags: - User summary: Okta Change Password description: Changes a user's password by validating the user's current password. This operation can only be performed on users in `STAGED`, `ACTIVE`, `PASSWORD_EXPIRED`, or `RECOVERY` status that have a valid password credential operationId: changePassword parameters: - name: userId in: path required: true schema: type: string - name: strict in: query schema: type: boolean x-okta-added-version: 1.10.0 x-okta-added-version: 1.10.0 requestBody: content: application/json: schema: $ref: '#/components/schemas/ChangePasswordRequest' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/UserCredentials' security: - api_token: [] x-codegen-request-body-name: changePasswordRequest /api/v1/users/{userId}/credentials/change_recovery_question: post: tags: - User summary: Okta Change Recovery Question description: Changes a user's recovery question & answer credential by validating the user's current password. This operation can only be performed on users in **STAGED**, **ACTIVE** or **RECOVERY** `status` that have a valid password credential operationId: changeRecoveryQuestion parameters: - name: userId in: path required: true schema: type: string requestBody: content: application/json: schema: $ref: '#/components/schemas/UserCredentials' required: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/UserCredentials' security: - api_token: [] x-codegen-request-body-name: userCredentials /api/v1/users/{userId}/credentials/forgot_password: post: tags: - User summary: Okta Forgot Password parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/ForgotPasswordResponse' security: - api_token: [] x-okta-multi-operation: - description: Generates a one-time token (OTT) that can be used to reset a user's password operationId: forgotPasswordGenerateOneTimeToken parameters: - default: true in: query name: sendEmail type: boolean - description: Sets a new password for a user by validating the user's answer to their current recovery question operationId: forgotPasswordSetNewPassword parameters: - in: body name: user required: true schema: $ref: '#/definitions/UserCredentials' - default: true in: query name: sendEmail type: boolean /api/v1/users/{userId}/grants: get: tags: - User description: Lists all grants for the specified user operationId: listUserGrants parameters: - name: userId in: path required: true schema: type: string - name: scopeId in: query schema: type: string - name: expand in: query schema: type: string - name: after in: query schema: type: string - name: limit in: query schema: type: integer format: int32 default: 20 responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/OAuth2ScopeConsentGrant' security: - api_token: [] delete: tags: - User description: Revokes all grants for a specified user operationId: revokeUserGrants parameters: - name: userId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/grants/{grantId}: get: tags: - User description: Gets a grant for the specified user operationId: getUserGrant parameters: - name: userId in: path required: true schema: type: string - name: grantId in: path required: true schema: type: string - name: expand in: query schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/OAuth2ScopeConsentGrant' security: - api_token: [] delete: tags: - User description: Revokes one grant for a specified user operationId: revokeUserGrant parameters: - name: userId in: path required: true schema: type: string - name: grantId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/groups: get: tags: - User summary: Okta Get Member Groups description: Fetches the groups of which the user is a member. operationId: listUserGroups parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/Group' security: - api_token: [] /api/v1/users/{userId}/idps: get: tags: - User summary: Okta Listing IdPs associated with a user description: Lists the IdPs associated with the user. operationId: listUserIdentityProviders parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/IdentityProvider' security: - api_token: [] /api/v1/users/{userId}/lifecycle/activate: post: tags: - User summary: Okta Activate User description: Activates a user. This operation can only be performed on users with a `STAGED` status. Activation of a user is an asynchronous operation. The user will have the `transitioningToStatus` property with a value of `ACTIVE` during activation to indicate that the user hasn't completed the asynchronous operation. The user will have a status of `ACTIVE` when the activation process is complete. operationId: activateUser parameters: - name: userId in: path required: true schema: type: string - name: sendEmail in: query description: Sends an activation email to the user if true required: true schema: type: boolean default: true responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/UserActivationToken' security: - api_token: [] /api/v1/users/{userId}/lifecycle/deactivate: post: tags: - User summary: Okta Deactivate User description: 'Deactivates a user. This operation can only be performed on users that do not have a `DEPROVISIONED` status. While the asynchronous operation (triggered by HTTP header `Prefer: respond-async`) is proceeding the user''s `transitioningToStatus` property is `DEPROVISIONED`. The user''s status is `DEPROVISIONED` when the deactivation process is complete.' operationId: deactivateUser parameters: - name: userId in: path required: true schema: type: string - name: sendEmail in: query schema: type: boolean default: false x-okta-added-version: 1.5.0 x-okta-added-version: 1.5.0 responses: '200': description: OK content: {} security: - api_token: [] /api/v1/users/{userId}/lifecycle/expire_password?tempPassword=false: post: tags: - User summary: Okta Expire Password description: This operation transitions the user to the status of `PASSWORD_EXPIRED` so that the user is required to change their password at their next login. operationId: expirePassword parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/User' security: - api_token: [] /api/v1/users/{userId}/lifecycle/expire_password?tempPassword=true: post: tags: - User summary: Okta Expire Password description: This operation transitions the user to the status of `PASSWORD_EXPIRED` and the user's password is reset to a temporary password that is returned. operationId: expirePasswordAndGetTemporaryPassword parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/TempPassword' security: - api_token: [] /api/v1/users/{userId}/lifecycle/reactivate: post: tags: - User summary: Okta Reactivate User description: Reactivates a user. This operation can only be performed on users with a `PROVISIONED` status. This operation restarts the activation workflow if for some reason the user activation was not completed when using the activationToken from [Activate User](#activate-user). operationId: reactivateUser parameters: - name: userId in: path required: true schema: type: string - name: sendEmail in: query description: Sends an activation email to the user if true schema: type: boolean default: false responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/UserActivationToken' security: - api_token: [] /api/v1/users/{userId}/lifecycle/reset_factors: post: tags: - User summary: Okta Reset Factors description: This operation resets all factors for the specified user. All MFA factor enrollments returned to the unenrolled state. The user's status remains ACTIVE. This link is present only if the user is currently enrolled in one or more MFA factors. operationId: resetFactors parameters: - name: userId in: path required: true schema: type: string responses: '200': description: OK content: {} security: - api_token: [] /api/v1/users/{userId}/lifecycle/reset_password: post: tags: - User summary: Okta Reset Password description: Generates a one-time token (OTT) that can be used to reset a user's password. The OTT link can be automatically emailed to the user or returned to the API caller and distributed using a custom flow. operationId: resetPassword parameters: - name: userId in: path required: true schema: type: string - name: sendEmail in: query required: true schema: type: boolean responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/ResetPasswordToken' security: - api_token: [] /api/v1/users/{userId}/lifecycle/suspend: post: tags: - User summary: Okta Suspend User description: Suspends a user. This operation can only be performed on users with an `ACTIVE` status. The user will have a status of `SUSPENDED` when the process is complete. operationId: suspendUser parameters: - name: userId in: path required: true schema: type: string responses: '200': description: OK content: {} security: - api_token: [] /api/v1/users/{userId}/lifecycle/unlock: post: tags: - User summary: Okta Unlock User description: Unlocks a user with a `LOCKED_OUT` status and returns them to `ACTIVE` status. Users will be able to login with their current password. operationId: unlockUser parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: {} security: - api_token: [] /api/v1/users/{userId}/lifecycle/unsuspend: post: tags: - User summary: Okta Unsuspend User description: Unsuspends a user and returns them to the `ACTIVE` state. This operation can only be performed on users that have a `SUSPENDED` status. operationId: unsuspendUser parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: {} security: - api_token: [] /api/v1/users/{userId}/linkedObjects/{relationshipName}: get: tags: - User description: Get linked objects for a user, relationshipName can be a primary or associated relationship name operationId: getLinkedObjectsForUser parameters: - name: userId in: path required: true schema: type: string - name: relationshipName in: path required: true schema: type: string - name: after in: query schema: type: string - name: limit in: query schema: type: integer format: int32 default: -1 responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/ResponseLinks' security: - api_token: [] delete: tags: - User description: Delete linked objects for a user, relationshipName can be ONLY a primary relationship name operationId: removeLinkedObjectForUser parameters: - name: userId in: path required: true schema: type: string - name: relationshipName in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/roles: get: tags: - User description: Lists all roles assigned to a user. operationId: listAssignedRolesForUser parameters: - name: userId in: path required: true schema: type: string - name: expand in: query schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/Role' security: - api_token: [] post: tags: - User description: Assigns a role to a user. operationId: assignRoleToUser parameters: - name: userId in: path required: true schema: type: string - name: disableNotifications in: query schema: type: boolean requestBody: content: application/json: schema: $ref: '#/components/schemas/AssignRoleRequest' required: true responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/Role' security: - api_token: [] x-codegen-request-body-name: assignRoleRequest /api/v1/users/{userId}/roles/{roleId}: get: tags: - User description: Gets role that is assigne to user. operationId: getUserRole parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/Role' security: - api_token: [] delete: tags: - User description: Unassigns a role from a user. operationId: removeRoleFromUser parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps: get: tags: - User description: Lists all App targets for an `APP_ADMIN` Role assigned to a User. This methods return list may include full Applications or Instances. The response for an instance will have an `ID` value, while Application will not have an ID. operationId: listApplicationTargetsForApplicationAdministratorRoleForUser parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: after in: query schema: type: string - name: limit in: query schema: type: integer format: int32 default: 20 responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/CatalogApplication' security: - api_token: [] put: tags: - User description: Success operationId: addAllAppsAsTargetToRole parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string responses: '200': description: Success content: {} security: - api_token: [] /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}: put: tags: - User description: Success operationId: addApplicationTargetToAdminRoleForUser parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: appName in: path required: true schema: type: string responses: '200': description: Success content: {} security: - api_token: [] delete: tags: - User description: Success operationId: removeApplicationTargetFromApplicationAdministratorRoleForUser parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: appName in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/roles/{roleId}/targets/catalog/apps/{appName}/{applicationId}: put: tags: - User summary: Okta Add App Instance Target to App Administrator Role given to a User description: Add App Instance Target to App Administrator Role given to a User operationId: addApplicationTargetToAppAdminRoleForUser parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: appName in: path required: true schema: type: string - name: applicationId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] delete: tags: - User summary: Okta Remove App Instance Target to App Administrator Role given to a User description: Remove App Instance Target to App Administrator Role given to a User operationId: removeApplicationTargetFromAdministratorRoleForUser parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: appName in: path required: true schema: type: string - name: applicationId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/roles/{roleId}/targets/groups: get: tags: - User description: Success operationId: listGroupTargetsForRole parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: after in: query schema: type: string - name: limit in: query schema: type: integer format: int32 default: 20 responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/Group' security: - api_token: [] /api/v1/users/{userId}/roles/{roleId}/targets/groups/{groupId}: put: tags: - User description: Success operationId: addGroupTargetToRole parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: groupId in: path required: true schema: type: string responses: '200': description: Success content: {} security: - api_token: [] delete: tags: - User description: Success operationId: removeGroupTargetFromRole parameters: - name: userId in: path required: true schema: type: string - name: roleId in: path required: true schema: type: string - name: groupId in: path required: true schema: type: string responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/sessions: delete: tags: - User description: Removes all active identity provider sessions. This forces the user to authenticate on the next operation. Optionally revokes OpenID Connect and OAuth refresh and access tokens issued to the user. operationId: clearUserSessions parameters: - name: userId in: path required: true schema: type: string - name: oauthTokens in: query description: Revoke issued OpenID Connect and OAuth refresh and access tokens schema: type: boolean default: false responses: '204': description: No Content content: {} security: - api_token: [] /api/v1/users/{userId}/subscriptions: get: tags: - User summary: Okta List subscriptions of a User description: List subscriptions of a User. Only lists subscriptions for current user. An AccessDeniedException message is sent if requests are made from other users. operationId: listUserSubscriptions parameters: - name: userId in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: type: array items: $ref: '#/components/schemas/Subscription' '404': description: Not Found content: {} security: - api_token: [] /api/v1/users/{userId}/subscriptions/{notificationType}: get: tags: - User summary: Okta Get the subscription of a User with a specific notification type description: Get the subscriptions of a User with a specific notification type. Only gets subscriptions for current user. An AccessDeniedException message is sent if requests are made from other users. operationId: getUserSubscriptionByNotificationType parameters: - name: userId in: path required: true schema: type: string - name: notificationType in: path required: true schema: type: string responses: '200': description: Success content: application/json: schema: $ref: '#/components/schemas/Subscription' '404': description: Not Found content: {} security: - api_token: [] components: schemas: ProtocolEndpoint: type: object properties: binding: type: string enum: - HTTP-POST - HTTP-REDIRECT destination: type: string type: type: string enum: - INSTANCE - ORG url: type: string x-okta-tags: - IdentityProvider ChangePasswordRequest: type: object properties: newPassword: $ref: '#/components/schemas/PasswordCredential' oldPassword: $ref: '#/components/schemas/PasswordCredential' x-okta-tags: - User OAuth2Client: type: object properties: _links: type: object additionalProperties: type: object properties: {} readOnly: true client_id: type: string readOnly: true client_name: type: string readOnly: true client_uri: type: string readOnly: true logo_uri: type: string readOnly: true x-okta-tags: - Application CatalogApplicationStatus: type: string enum: - ACTIVE - INACTIVE x-okta-tags: - Role AuthenticationProvider: type: object properties: name: type: string type: $ref: '#/components/schemas/AuthenticationProviderType' x-okta-tags: - User ProvisioningDeprovisionedCondition: type: object properties: action: type: string enum: - NONE - REACTIVATE x-okta-tags: - IdentityProvider OAuth2Actor: type: object properties: id: type: string readOnly: true type: type: string x-okta-tags: - Application OAuth2ScopeConsentGrantStatus: type: string enum: - ACTIVE - REVOKED x-okta-tags: - Application UserType: type: object properties: _links: type: object additionalProperties: type: object properties: {} readOnly: true created: type: string format: date-time readOnly: true createdBy: type: string readOnly: true default: type: boolean readOnly: true description: type: string displayName: type: string id: type: string lastUpdated: type: string format: date-time readOnly: true lastUpdatedBy: type: string readOnly: true name: type: string x-okta-crud: - alias: create arguments: - dest: userType self: true operationId: createUserType - alias: update arguments: - dest: typeId src: id - dest: userType self: true operationId: updateUserType - alias: read arguments: - dest: typeId src: id operationId: getUserType - alias: delete arguments: - dest: typeId src: id operationId: deleteUserType x-okta-operations: - alias: replaceUserType arguments: - dest: roleId src: id operationId: replaceUserType x-okta-tags: - UserType OAuth2ScopeConsentGrant: type: object properties: _embedded: type: object additionalProperties: type: object properties: {} readOnly: true _links: type: object additionalProperties: type: object properties: {} readOnly: true clientId: type: string created: type: string format: date-time readOnly: true createdBy: $ref: '#/components/schemas/OAuth2Actor' id: type: string readOnly: true issuer: type: string lastUpdated: type: string format: date-time readOnly: true scopeId: type: string source: $ref: '#/components/schemas/OAuth2ScopeConsentGrantSource' status: $ref: '#/components/schemas/OAuth2ScopeConsentGrantStatus' userId: type: string x-okta-tags: - Application OAuth2RefreshToken: type: object properties: _embedded: type: object additionalProperties: type: object properties: {} readOnly: true _links: type: object additionalProperties: type: object properties: {} readOnly: true clientId: type: string created: type: string format: date-time readOnly: true createdBy: $ref: '#/components/schemas/OAuth2Actor' expiresAt: type: string format: date-time readOnly: true id: type: string readOnly: true issuer: type: string lastUpdated: type: string format: date-time readOnly: true scopes: type: array items: type: string status: type: string enum: - ACTIVE - REVOKED userId: type: string x-okta-tags: - Application ProtocolAlgorithmTypeSignature: type: object properties: algorithm: type: string scope: type: string enum: - RESPONSE - TOKEN - ANY - REQUEST - NONE x-okta-tags: - IdentityProvider ProtocolEndpoints: type: object properties: acs: $ref: '#/components/schemas/ProtocolEndpoint' authorization: $ref: '#/components/schemas/ProtocolEndpoint' jwks: $ref: '#/components/schemas/ProtocolEndpoint' metadata: $ref: '#/components/schemas/ProtocolEndpoint' slo: $ref: '#/components/schemas/ProtocolEndpoint' sso: $ref: '#/components/schemas/ProtocolEndpoint' token: $ref: '#/components/schemas/ProtocolEndpoint' userInfo: $ref: '#/components/schemas/ProtocolEndpoint' x-okta-tags: - IdentityProvider ProvisioningConditions: type: object properties: deprovisioned: $ref: '#/components/schemas/ProvisioningDeprovisionedCondition' suspended: $ref: '#/components/schemas/ProvisioningSuspendedCondition' x-okta-tags: - IdentityProvider User: type: object properties: _embedded: type: object additionalProperties: type: object properties: {} readOnly: true _links: type: object additionalProperties: type: object properties: {} readOnly: true activated: type: string format: date-time readOnly: true created: type: string format: date-time readOnly: true credentials: $ref: '#/components/schemas/UserCredentials' id: type: string readOnly: true lastLogin: type: string format: date-time readOnly: true lastUpdated: type: string format: date-time readOnly: true passwordChanged: type: string format: date-time readOnly: true profile: $ref: '#/components/schemas/UserProfile' status: $ref: '#/components/schemas/UserStatus' statusChanged: type: string format: date-time readOnly: true transitioningToStatus: $ref: '#/components/schemas/UserStatus' type: $ref: '#/components/schemas/UserType' x-okta-crud: - alias: create arguments: - dest: user self: true operationId: createUser - alias: read arguments: [] operationId: getUser - alias: update arguments: - dest: userId src: id - dest: user self: true operationId: updateUser - alias: delete arguments: - dest: userId src: id - dest: user self: true operationId: deactivateOrDeleteUser x-okta-operations: - alias: listAppLinks arguments: - dest: userId src: id operationId: listAppLinks - alias: changePassword arguments: - dest: userId src: id operationId: changePassword - alias: changeRecoveryQuestion arguments: - dest: userId src: id operationId: changeRecoveryQuestion - alias: forgotPasswordSetNewPassword arguments: - dest: userId src: id operationId: forgotPasswordSetNewPassword - alias: forgotPasswordGenerateOneTimeToken arguments: - dest: userId src: id operationId: forgotPasswordGenerateOneTimeToken - alias: assignRole arguments: - dest: userId src: id operationId: assignRoleToUser - alias: getRole arguments: - dest: userId src: id operationId: getUserRole - alias: removeRole arguments: - dest: userId src: id operationId: removeRoleFromUser - alias: listGroupTargets arguments: - dest: userId src: id operationId: listGroupTargetsForRole - alias: removeGroupTarget arguments: - dest: userId src: id operationId: removeGroupTargetFromRole - alias: addGroupTarget arguments: - dest: userId src: id operationId: addGroupTargetToRole - alias: listAssignedRoles arguments: - dest: userId src: id operationId: listAssignedRolesForUser - alias: addAllAppsAsTarget arguments: - dest: userId src: id operationId: addAllAppsAsTargetToRole - alias: listGroups arguments: - dest: userId src: id operationId: listUserGroups - alias: listGrants arguments: - dest: userId src: id operationId: listUserGrants - alias: revokeGrants arguments: - dest: userId src: id operationId: revokeUserGrants - alias: revokeGrant arguments: - dest: userId src: id operationId: revokeUserGrant - alias: revokeGrantsForUserAndClient arguments: - dest: userId src: id operationId: revokeGrantsForUserAndClient - alias: listRefreshTokensForUserAndClient arguments: - dest: userId src: id operationId: listRefreshTokensForUserAndClient - alias: revokeTokenForUserAndClient arguments: - dest: userId src: id operationId: revokeTokenForUserAndClient - alias: getRefreshTokenForUserAndClient arguments: - dest: userId src: id operationId: getRefreshTokenForUserAndClient - alias: revokeTokensForUserAndClient arguments: - dest: userId src: id operationId: revokeTokensForUserAndClient - alias: listClients arguments: - dest: userId src: id operationId: listUserClients - alias: activate arguments: - dest: userId src: id operationId: activateUser - alias: reactivate arguments: - dest: userId src: id operationId: reactivateUser - alias: deactivate arguments: - dest: userId src: id operationId: deactivateUser - alias: suspend arguments: - dest: userId src: id operationId: suspendUser - alias: unsuspend arguments: - dest: userId src: id operationId: unsuspendUser - alias: resetPassword arguments: - dest: userId src: id operationId: resetPassword - alias: expirePassword arguments: - dest: userId src: id operationId: expirePassword - alias: expirePasswordAndGetTemporaryPassword arguments: - dest: userId src: id operationId: expirePasswordAndGetTemporaryPassword - alias: unlock arguments: - dest: userId src: id operationId: unlockUser - alias: resetFactors arguments: - dest: userId src: id operationId: resetFactors - alias: deleteFactor arguments: - dest: userId src: id operationId: deleteFactor - alias: addToGroup arguments: - dest: userId src: id description: Adds a user to a group with 'OKTA_GROUP' type operationId: addUserToGroup - alias: enrollFactor arguments: - dest: userId src: id operationId: enrollFactor - alias: listSupportedFactors arguments: - dest: userId src: id operationId: listSupportedFactors - alias: listFactors arguments: - dest: userId src: id operationId: listFactors - alias: listSupportedSecurityQuestions arguments: - dest: userId src: id operationId: listSupportedSecurityQuestions - alias: getFactor arguments: - dest: userId src: id operationId: getFactor - alias: setLinkedObject arguments: - dest: associatedUserId src: id operationId: setLinkedObjectForUser - alias: listIdentityProviders arguments: - dest: userId src: id operationId: listUserIdentityProviders - alias: getLinkedObjects arguments: - dest: userId src: id operationId: getLinkedObjectsForUser - alias: clearSessions arguments: - dest: userId src: id operationId: clearUserSessions - alias: removeLinkedObject arguments: - dest: userId src: id operationId: removeLinkedObjectForUser x-okta-tags: - User Provisioning: type: object properties: action: type: string enum: - AUTO - CALLOUT - DISABLED conditions: $ref: '#/components/schemas/ProvisioningConditions' groups: $ref: '#/components/schemas/ProvisioningGroups' profileMaster: type: boolean x-okta-tags: - IdentityProvider Role: type: object properties: _embedded: type: object additionalProperties: type: object properties: {} readOnly: true _links: type: object additionalProperties: type: object properties: {} readOnly: true assignmentType: $ref: '#/components/schemas/RoleAssignmentType' created: type: string format: date-time readOnly: true description: type: string id: type: string readOnly: true label: type: string readOnly: true lastUpdated: type: string format: date-time readOnly: true status: $ref: '#/components/schemas/RoleStatus' type: $ref: '#/components/schemas/RoleType' x-okta-operations: - alias: addAdminGroupTarget arguments: - dest: roleId src: id - dest: groupId parentSrc: id operationId: addGroupTargetToGroupAdministratorRoleForGroup - alias: addAppInstanceTargetToAdminRole arguments: - dest: roleId src: id - dest: groupId parentSrc: id operationId: addApplicationInstanceTargetToAppAdminRoleGivenToGroup - alias: addAppTargetToAdminRole arguments: - dest: roleId src: id - dest: groupId parentSrc: id operationId: addApplicationTargetToAdminRoleGivenToGroup - alias: addAllAppsAsTargetToRole arguments: - dest: roleId src: id - dest: userId parentSrc: id operationId: addAllAppsAsTargetToRole - alias: addAppTargetToAppAdminRoleForUser arguments: - dest: roleId src: id - dest: userId parentSrc: id operationId: addApplicationTargetToAppAdminRoleForUser - alias: addAppTargetToAdminRoleForUser arguments: - dest: roleId src: id - dest: userId parentSrc: id operationId: addApplicationTargetToAdminRoleForUser x-okta-tags: - User UserActivationToken: type: object properties: activationToken: type: string readOnly: true activationUrl: type: string readOnly: true x-okta-tags: - User PasswordCredentialHash: type: object properties: algorithm: $ref: '#/components/schemas/PasswordCredentialHashAlgorithm' salt: type: string saltOrder: type: string value: type: string workFactor: type: integer x-okta-tags: - User RoleAssignmentType: type: string enum: - GROUP - USER x-okta-tags: - Role PasswordCredential: type: object properties: hash: $ref: '#/components/schemas/PasswordCredentialHash' hook: $ref: '#/components/schemas/PasswordCredentialHook' value: type: string format: password x-okta-tags: - User ProtocolAlgorithmType: type: object properties: signature: $ref: '#/components/schemas/ProtocolAlgorithmTypeSignature' x-okta-tags: - IdentityProvider IdentityProviderCredentialsSigning: type: object properties: kid: type: string privateKey: type: string teamId: type: string x-okta-tags: - IdentityProvider SubscriptionStatus: type: string enum: - subscribed - unsubscribed x-okta-tags: - Role ForgotPasswordResponse: type: object properties: resetPasswordUrl: type: string readOnly: true x-okta-tags: - User AssignRoleRequest: type: object properties: type: $ref: '#/components/schemas/RoleType' x-okta-tags: - Role UserStatus: type: string enum: - ACTIVE - DEPROVISIONED - LOCKED_OUT - PASSWORD_EXPIRED - PROVISIONED - RECOVERY - STAGED - SUSPENDED x-okta-tags: - User PolicySubject: type: object properties: filter: type: string format: type: array items: type: string matchAttribute: type: string matchType: $ref: '#/components/schemas/PolicySubjectMatchType' userNameTemplate: $ref: '#/components/schemas/PolicyUserNameTemplate' x-okta-tags: - Policy CreateUserRequest: type: object properties: credentials: $ref: '#/components/schemas/UserCredentials' groupIds: type: array items: type: string profile: $ref: '#/components/schemas/UserProfile' type: $ref: '#/components/schemas/UserType' x-okta-tags: - User AppLink: type: object properties: appAssignmentId: type: string readOnly: true appInstanceId: type: string readOnly: true appName: type: string readOnly: true credentialsSetup: type: boolean readOnly: true hidden: type: boolean readOnly: true id: type: string readOnly: true label: type: string readOnly: true linkUrl: type: string readOnly: true logoUrl: type: string readOnly: true sortOrder: type: integer readOnly: true x-okta-tags: - User PolicyAccountLink: type: object properties: action: type: string enum: - AUTO - DISABLED filter: $ref: '#/components/schemas/PolicyAccountLinkFilter' x-okta-tags: - Policy ProtocolRelayStateFormat: type: string enum: - OPAQUE - FROM_URL x-okta-tags: - IdentityProvider AuthenticationProviderType: type: string enum: - ACTIVE_DIRECTORY - FEDERATION - LDAP - OKTA - SOCIAL - IMPORT x-okta-tags: - User CatalogApplication: type: object properties: _links: type: object additionalProperties: type: object properties: {} readOnly: true category: type: string description: type: string displayName: type: string features: type: array items: type: string id: type: string readOnly: true lastUpdated: type: string format: date-time readOnly: true name: type: string signOnModes: type: array items: type: string status: $ref: '#/components/schemas/CatalogApplicationStatus' verificationStatus: type: string website: type: string x-okta-tags: - Role RoleType: type: string enum: - SUPER_ADMIN - ORG_ADMIN - APP_ADMIN - USER_ADMIN - HELP_DESK_ADMIN - READ_ONLY_ADMIN - MOBILE_ADMIN - API_ACCESS_MANAGEMENT_ADMIN - REPORT_ADMIN - GROUP_MEMBERSHIP_ADMIN - CUSTOM x-okta-tags: - Role Group: type: object properties: _embedded: type: object additionalProperties: type: object properties: {} readOnly: true _links: type: object additionalProperties: type: object properties: {} readOnly: true created: type: string format: date-time readOnly: true id: type: string readOnly: true lastMembershipUpdated: type: string format: date-time readOnly: true lastUpdated: type: string format: date-time readOnly: true objectClass: type: array readOnly: true items: type: string profile: $ref: '#/components/schemas/GroupProfile' type: $ref: '#/components/schemas/GroupType' x-okta-crud: - alias: update arguments: - dest: groupId src: id - dest: group self: true operationId: updateGroup - alias: delete arguments: - dest: groupId src: id operationId: deleteGroup x-okta-operations: - alias: removeUser arguments: - dest: groupId src: id operationId: removeUserFromGroup - alias: listUsers arguments: - dest: groupId src: id operationId: listGroupUsers - alias: listApplications arguments: - dest: groupId src: id operationId: listAssignedApplicationsForGroup - alias: assignRole arguments: - dest: groupId src: id operationId: assignRoleToGroup x-okta-tags: - Group IdentityProviderCredentialsClient: type: object properties: client_id: type: string client_secret: type: string x-okta-tags: - IdentityProvider ProtocolSettings: type: object properties: nameFormat: type: string x-okta-tags: - IdentityProvider ProvisioningSuspendedCondition: type: object properties: action: type: string enum: - NONE - UNSUSPEND x-okta-tags: - IdentityProvider ResetPasswordToken: type: object properties: resetPasswordUrl: type: string readOnly: true x-okta-tags: - User IdentityProviderCredentials: type: object properties: client: $ref: '#/components/schemas/IdentityProviderCredentialsClient' signing: $ref: '#/components/schemas/IdentityProviderCredentialsSigning' trust: $ref: '#/components/schemas/IdentityProviderCredentialsTrust' x-okta-tags: - IdentityProvider ResponseLinks: type: object properties: _links: type: object additionalProperties: type: object properties: {} readOnly: true x-okta-tags: - User UserProfile: type: object properties: city: type: string costCenter: type: string countryCode: type: string department: type: string displayName: type: string division: type: string email: type: string employeeNumber: type: string firstName: type: string honorificPrefix: type: string honorificSuffix: type: string lastName: type: string locale: type: string login: type: string manager: type: string managerId: type: string middleName: type: string mobilePhone: type: string nickName: type: string organization: type: string postalAddress: type: string preferredLanguage: type: string primaryPhone: type: string profileUrl: type: string secondEmail: type: string state: type: string streetAddress: type: string timezone: type: string title: type: string userType: type: string zipCode: type: string x-okta-extensible: true x-okta-tags: - User Subscription: type: object properties: _links: type: object additionalProperties: type: object properties: {} readOnly: true channels: type: array items: type: string notificationType: $ref: '#/components/schemas/NotificationType' status: $ref: '#/components/schemas/SubscriptionStatus' x-okta-operations: - alias: listRoleSubscriptions operationId: listRoleSubscriptions - alias: getRoleSubscriptionByNotificationType operationId: getRoleSubscriptionByNotificationType - alias: getUserSubscriptionByNotificationType operationId: getUserSubscriptionByNotificationType - alias: listUserSubscriptions operationId: listUserSubscriptions - alias: subscribeUserSubscriptionByNotificationType operationId: subscribeUserSubscriptionByNotificationType - alias: unsubscribeRoleSubscriptionByNotificationType operationId: unsubscribeRoleSubscriptionByNotificationType - alias: subscribeRoleSubscriptionByNotificationType operationId: subscribeRoleSubscriptionByNotificationType - alias: unsubscribeUserSubscriptionByNotificationType operationId: unsubscribeUserSubscriptionByNotificationType x-okta-tags: - Role PasswordCredentialHook: type: object properties: type: type: string x-okta-tags: - User IdentityProvider: type: object properties: _links: type: object additionalProperties: type: object properties: {} readOnly: true created: type: string format: date-time readOnly: true id: type: string readOnly: true issuerMode: type: string enum: - ORG_URL - CUSTOM_URL - DYNAMIC lastUpdated: type: string format: date-time readOnly: true name: type: string policy: $ref: '#/components/schemas/IdentityProviderPolicy' protocol: $ref: '#/components/schemas/Protocol' status: type: string enum: - ACTIVE - INACTIVE type: type: string enum: - SAML2 - GOOGLE - FACEBOOK - LINKEDIN - MICROSOFT - OIDC - OKTA - IWA - AgentlessDSSO - X509 x-okta-known-values: - SAML2 - GOOGLE - FACEBOOK - LINKEDIN - MICROSOFT - OIDC - OKTA - IWA - AgentlessDSSO - X509 x-okta-crud: - alias: create arguments: - dest: idpTrust self: true operationId: createIdentityProvider - alias: read arguments: [] operationId: getIdentityProvider - alias: update arguments: - dest: idpId src: id - dest: idpTrust self: true operationId: updateIdentityProvider - alias: delete arguments: - dest: idpId src: id operationId: deleteIdentityProvider x-okta-operations: - alias: listSigningCsrs arguments: - dest: idpId src: id operationId: listCsrsForIdentityProvider - alias: generateCsr arguments: - dest: idpId src: id operationId: generateCsrForIdentityProvider - alias: deleteSigningCsr arguments: - dest: idpId src: id operationId: revokeCsrForIdentityProvider - alias: getSigningCsr arguments: - dest: idpId src: id operationId: getCsrForIdentityProvider - alias: listSigningKeys arguments: - dest: idpId src: id operationId: listIdentityProviderSigningKeys - alias: generateSigningKey arguments: - dest: idpId src: id operationId: generateIdentityProviderSigningKey - alias: getSigningKey arguments: - dest: idpId src: id operationId: getIdentityProviderSigningKey - alias: cloneKey arguments: - dest: idpId src: id operationId: cloneIdentityProviderKey - alias: activate arguments: - dest: idpId src: id operationId: activateIdentityProvider - alias: deactivate arguments: - dest: idpId src: id operationId: deactivateIdentityProvider - alias: listUsers arguments: - dest: idpId src: id operationId: listIdentityProviderApplicationUsers - alias: unlinkUser arguments: - dest: idpId src: id operationId: unlinkUserFromIdentityProvider - alias: getUser arguments: - dest: idpId src: id operationId: getIdentityProviderApplicationUser - alias: linkUser arguments: - dest: idpId src: id operationId: linkUserToIdentityProvider - alias: listSocialAuthTokens arguments: - dest: idpId src: id operationId: listSocialAuthTokens x-okta-tags: - IdentityProvider PolicyUserNameTemplate: type: object properties: template: type: string x-okta-tags: - Policy ProtocolAlgorithms: type: object properties: request: $ref: '#/components/schemas/ProtocolAlgorithmType' response: $ref: '#/components/schemas/ProtocolAlgorithmType' x-okta-tags: - IdentityProvider OAuth2ScopeConsentGrantSource: type: string enum: - END_USER - ADMIN x-okta-tags: - Application NotificationType: type: string enum: - CONNECTOR_AGENT - USER_LOCKED_OUT - APP_IMPORT - LDAP_AGENT - AD_AGENT - OKTA_ANNOUNCEMENT - OKTA_ISSUE - OKTA_UPDATE - IWA_AGENT - USER_DEPROVISION - REPORT_SUSPICIOUS_ACTIVITY - RATELIMIT_NOTIFICATION x-okta-tags: - Subscription PasswordCredentialHashAlgorithm: type: string enum: - BCRYPT - SHA-512 - SHA-256 - SHA-1 - MD5 x-okta-tags: - User RecoveryQuestionCredential: type: object properties: answer: type: string question: type: string x-okta-tags: - User PolicyAccountLinkFilter: type: object properties: groups: $ref: '#/components/schemas/PolicyAccountLinkFilterGroups' x-okta-tags: - Policy ProvisioningGroups: type: object properties: action: type: string enum: - NONE - APPEND - SYNC - ASSIGN assignments: type: array items: type: string filter: type: array items: type: string sourceAttributeName: type: string x-okta-tags: - IdentityProvider GroupProfile: type: object properties: description: type: string name: type: string x-okta-extensible: true x-okta-tags: - Group GroupType: type: string enum: - OKTA_GROUP - APP_GROUP - BUILT_IN x-okta-tags: - Group IdentityProviderCredentialsTrust: type: object properties: audience: type: string issuer: type: string kid: type: string revocation: type: string enum: - CRL - DELTA_CRL - OCSP revocationCacheLifetime: type: integer x-okta-tags: - IdentityProvider PolicyAccountLinkFilterGroups: type: object properties: include: type: array items: type: string x-okta-tags: - Policy ProtocolRelayState: type: object properties: format: $ref: '#/components/schemas/ProtocolRelayStateFormat' x-okta-tags: - IdentityProvider IdentityProviderPolicy: type: object properties: accountLink: $ref: '#/components/schemas/PolicyAccountLink' maxClockSkew: type: integer provisioning: $ref: '#/components/schemas/Provisioning' subject: $ref: '#/components/schemas/PolicySubject' x-okta-parent: '#/definitions/Policy' x-okta-tags: - Policy RoleStatus: type: string enum: - ACTIVE - INACTIVE x-okta-tags: - User TempPassword: type: object properties: tempPassword: type: string readOnly: true x-okta-tags: - User UserCredentials: type: object properties: password: $ref: '#/components/schemas/PasswordCredential' provider: $ref: '#/components/schemas/AuthenticationProvider' recovery_question: $ref: '#/components/schemas/RecoveryQuestionCredential' x-okta-tags: - User Protocol: type: object properties: algorithms: $ref: '#/components/schemas/ProtocolAlgorithms' credentials: $ref: '#/components/schemas/IdentityProviderCredentials' endpoints: $ref: '#/components/schemas/ProtocolEndpoints' issuer: $ref: '#/components/schemas/ProtocolEndpoint' relayState: $ref: '#/components/schemas/ProtocolRelayState' scopes: type: array items: type: string settings: $ref: '#/components/schemas/ProtocolSettings' type: type: string enum: - SAML2 - OIDC - OAUTH2 - MTLS x-okta-tags: - IdentityProvider PolicySubjectMatchType: type: string enum: - USERNAME - EMAIL - USERNAME_OR_EMAIL - CUSTOM_ATTRIBUTE x-okta-tags: - Policy securitySchemes: api_token: type: apiKey description: SSWS {API Token} name: Authorization in: header externalDocs: description: Find more info here url: https://developer.okta.com/docs/api/getting_started/design_principles.html