Okta integration

Overview

Okta is the identity / SSO / IGA platform – users, groups, apps, SAML/OIDC SSO, MFA. The Automize Okta connector covers user lifecycle (create / activate / suspend / unlock / deactivate), group membership, app assignments, MFA factors, and system logs.

• Regions: Each Okta tenant has its own sub-domain (yourcompany.okta.com or yourcompany.oktapreview.com for preview).
• Plans: Okta Workforce + Customer Identity. API is on all paid plans. Lifecycle Management features (advanced provisioning) on higher tiers.

Setting up the connection

Auth type: API Key.

1. Sign in to Okta Admin → Security → API → Tokens → Create Token.
2. Name it (e.g. Automize). Token inherits the creator's permissions – make the user a Super Admin or scope down.
3. Copy the token (only displayed once).
4. In Automize, open Settings → Connectors → Okta → Add connection. Enter Okta sub-domain + token. The connector uses 'SSWS <token>' auth header.

Find your credentials at https://yourcompany-admin.okta.com/admin/access/api/tokens.

Rate limits

Per-org request limits scale by plan (~600 req/min on Enterprise). Per-endpoint limits stricter for write ops (~60/min on most). Connector reads X-Rate-Limit-Remaining + Retry-After.

Data model

Identity:

    Org ─┬─ Users (lifecycle: STAGED → ACTIVE → SUSPENDED / DEPROVISIONED / LOCKED_OUT)
         ├─ Groups (rule-based or manual)
         ├─ Applications (SAML/OIDC apps, SCIM-provisioned)
         │     └─ App Assignments (user/group ↔ app, with profile mappings)
         ├─ Factors (MFA enrollments per user)
         ├─ Authorization Servers (OAuth scopes for custom APIs)
         └─ System Logs (audit trail)

Available operations

19 operations available. Click any row to jump to its detail.

Operations

Activate User

Activate a user

Tips

• STAGED → ACTIVE. sendEmail=true (default) emails activation link; false returns an activation_url to send yourself.

Add user to group

Add a user to an Okta group.

Tips

• group_id + user_id. Membership rules can override if it's a rule-based group.

Assign App to User

Assign an application to a user

Tips

• Direct user-to-app assignment. Group assignments are recommended over direct.

Create User

Create a new user

Tips

• profile: {firstName, lastName, email, login}. login often = email.
• credentials.password.value for a starting password (or omit + activate via email).
• activate=true to activate immediately; false to leave STAGED.
• groupIds: array of group IDs to add the new user to.

Deactivate User

Deactivate a user

Tips

• Any state → DEPROVISIONED. Irreversible – to re-activate, must use Reactivate (not just Activate).

Get User

Get user details

Tips

• user_id (Okta internal), login (username), or email.

Get User Schema

Get the user profile schema (standard + custom attributes)

No input parameters.

Tips

• Returns standard + custom attribute definitions. Use to discover what fields are available on user profiles.

List Applications

List all applications

No input parameters.

Tips

• All SSO apps in the org. Filter: 'status eq "ACTIVE"'.

List MFA Factors

List enrolled MFA factors for a user

Tips

• Returns enrolled MFA factors per user (Okta Verify, SMS, Voice, etc.).

List group members

List members of an Okta group.

Tips

• group_id. Returns user objects.

List Groups

List all groups

No input parameters.

Tips

• Filter: 'type eq "OKTA_GROUP"' (manual) or 'type eq "BUILT_IN"' or 'type eq "APP_GROUP"'.

List System Logs

List system log events

No input parameters.

Tips

• System Log – audit trail. Filter via since + until + filter (SCIM-style).
• Common queries: user lifecycle events, failed sign-ins, admin actions.

List Users

List all users

No input parameters.

Tips

• Page via after cursor (link headers). limit max 200.
• filter: SCIM-style – 'status eq "ACTIVE"', 'profile.email eq "foo@bar.com"', 'profile.department eq "Engineering"'.
• search: full-text across name/email/login (eventually consistent).

Remove user from group

Remove a user from an Okta group.

Tips

• Manual removal. Rule-based memberships auto-recalculate.

Reset password

Reset an Okta user password.

Tips

• sendEmail=true (default) emails the user a reset link. false returns a reset_password_url.

Suspend user

Suspend an Okta user.

Tips

• ACTIVE → SUSPENDED. Temporary lockout; reversible via Unsuspend.

Unlock user

Unlock an Okta user account.

Tips

• LOCKED_OUT → ACTIVE. Used after a user hits the password failure threshold.

Unsuspend user

Unsuspend an Okta user.

Tips

• SUSPENDED → ACTIVE.

Update User

Update user profile

Tips

• PATCH-style on profile. Updating login changes the user's sign-in name.

FAQ

Token vs OAuth – which?

API tokens (SSWS) are simple, no expiry – fine for backend automation. OAuth 2 with private key JWT is more secure (rotatable, scoped) – required for some Enterprise features. Connector uses SSWS.

User lifecycle states – which transitions are valid?

STAGED → ACTIVATE → ACTIVE. ACTIVE → SUSPEND → SUSPENDED → UNSUSPEND → ACTIVE. ACTIVE → DEACTIVATE → DEPROVISIONED (terminal – use Reactivate to recover). LOCKED_OUT happens automatically on failed passwords; clear with Unlock.

Why does Create User return 'PROFILE_INVALID'?

Missing a required profile attribute (sometimes custom). Check Get User Schema for required fields in your org's user profile.

Search vs filter?

Filter is exact match (SCIM operators). Search is full-text + fuzzy. Search is eventually consistent – new users take a few seconds to appear. Use filter for exact lookups.

Related connectors

• Microsoft-graph
• Workday