All Classes and Interfaces
Class
Description
Contains additional properties about custom AAGUID.
AAGUIDGroupObject
AccessPolicy
Consists of a `POSSESSION` constraint, a `KNOWLEDGE` constraint, or both.
Gets or Sets methods
Gets or Sets types
Specifies constraints for the authenticator.
Link to the app access policy resource
AccessPolicyRule
AccessPolicyRuleActions
Specifies the results when a user attempts to sign in
Gets or Sets AccessPolicyRuleApplicationSignOnAccess
AccessPolicyRuleConditions
Specifies [Okta Expression
Language](https://developer.okta.com/docs/reference/okta-expression-language-in-identity-engine/) expressions
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>The algorithm for encrypting access
tokens issued by this authorization server.
An array of ACS endpoints.
ActionProvider
Type of action provider
Gets or Sets ActionProviderType
Action to apply to a user
The scope of the group in Active Directory
The type of the group in Active Directory
AddGroupRequest
AddJwkRequest
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
Settings specific to the Okta Admin Console
Agent details
Details about the Active Directory group membership update
AgentJsonSigningKeyCommon
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
AgentJsonSigningKeyRequest
The cryptographic curve that's used for the key pair
Cryptographic algorithm family for the certificate's key pair
Status of the AI agent JSON Web Key
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
AgentJsonSigningKeyResponse
The cryptographic curve that's used for the key pair
Cryptographic algorithm family for the certificate's key pair
Status of the AI agent JSON Web Key
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
An EC signing key
The cryptographic curve that's used for the key pair
Cryptographic algorithm family for the certificate's key pair
Status of the AI agent JSON Web Key
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
An EC signing key
The cryptographic curve that's used for the key pair
Cryptographic algorithm family for the certificate's key pair
Status of the AI agent JSON Web Key
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
AgentJsonWebKeyRequestBase
Status of the AI agent JSON Web Key
AgentJsonWebKeyResponseBase
An RSA signing key
Cryptographic algorithm family for the certificate's key pair
Status of the AI agent JSON Web Key
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
An RSA signing key
Cryptographic algorithm family for the certificate's key pair
Status of the AI agent JSON Web Key
Acceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use`
is always `sig`.
An agent pool is a collection of agents that serve a common purpose.
Various information about agent auto-update configuration
Setting for auto-update
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an AI agent using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
Agent types that are being monitored
Status for one agent regarding the status to auto-update that agent
Overall state for the auto-update job from the admin perspective
AIAgent
When an AI agent is created, it's in the STAGED status.
AIAgentOperationListResponse
AIAgentOperationListResponseLinks
AIAgentOperationResponse
The status of the AI agent operation
The AI agent operation type
AI agent profile
The AI agent resource associated with the operation.
The allowed types of uses for the authenticator
Android Device Trust integration provider
A stateless data object that represents a complete API response.
APIServiceIntegrationInstance
APIServiceIntegrationInstanceSecret
Status of the API Service Integration instance Secret
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
An API token for an Okta User.
The Network Condition of the API Token
An API Token Update Object for an Okta user.
APNSConfiguration
APNSPushProvider
Container details for resource type APP_ACCOUNT
AppAccountContainerLink
AppAndInstanceConditionEvaluatorAppOrInstance
Specifies apps to include or exclude.
Type of app
Additional app configuration for group push mappings.
AppConfigActiveDirectory
The type of the app configuration
AppConnectionUserProvisionJWKList
AppConnectionUserProvisionJWKResponse
AppCustomHrefObject
Describes allowed HTTP verbs for the `href`
AppGroup
Authorization server for app instance connections
Current status of the application instance
AppInstancePolicyRuleCondition
AppInstanceProperty
Information used to generate the secret JSON Web Token for the token requests to Apple IdP > **Note:** The
`privateKey` property is required for a CREATE request.
Application
Gets or Sets features
Specifies access settings for the app
Capabilities supported by the app
Credentials for the specified `signOnMode`
ApplicationCredentialsOAuthClient
Apps with `BASIC_AUTH`, `BROWSER_PLUGIN`, or `SECURE_PASSWORD_STORE` sign-on modes have
credentials vaulted by Okta and can be configured with the following schemes.
App signing key properties > **Note:** Only apps with SAML_2_0, SAML_1_1, WS_FEDERATION, or OPENID_CONNECT
`signOnMode` support the key rotation feature.
Specifies the intended use of the key
The template used to generate the username when the app is assigned through a group or directly to a user
Determines if the username is pushed to the app on updates for CUSTOM `type`
Type of mapping expression.
Embedded resources related to the app using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
<div class=\"x-lifecycle-container\"><x-lifecycle
class=\"oie\"></x-lifecycle></div> Indicates which Express Configuration capabilities
the app supports and has enabled
The Feature object is used to configure app feature settings.
Key name of the feature | Feature name | Description | | --------- | ------------- | | USER_PROVISIONING | User
profiles are pushed from Okta to the third-party app.
The Application Group object that defines a group of users' app-specific profile and credentials for an app
ApplicationGroupAssignmentLinks
ApplicationLayout
ApplicationLayoutRule
ApplicationLayoutRuleCondition
ApplicationLayouts
ApplicationLayoutsLinks
Licenses for the app
App instance status
Discoverable resources related to the app
App settings
The entitlement management opt-in status for the app
App notes visible to either the admin or end user
Specifies notifications settings for the app
Sends customizable messages with conditions to end users when a VPN connection is required
Defines network zones for VPN notification
Specifies the VPN connection details required to access the app
Authentication mode for the app | signOnMode | Description | | ---------- | ----------- | | AUTO_LOGIN | Secure Web
Authentication (SWA) | | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | | BOOKMARK | Just a
bookmark (no-authentication) | | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | |
OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | | SAML_1_1 | Federated Authentication with
SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | |
SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | | WS_FEDERATION | Federated
Authentication with WS-Federation Passive Requestor Profile | Select the `signOnMode` for your custom app:
The type of client application.
<div class=\"x-lifecycle-container\"><x-lifecycle
class=\"oie\"></x-lifecycle></div> Universal Logout properties for the app.
Indicates whether the app uses a shared identity stack that may cause the user to sign out of other apps by the
same company
The protocol used for Universal Logout
Universal Logout status for the app instance
Indicates whether the app supports full or partial Universal Logout (UL).
Specifies visibility settings for the app
Hides the app for specific end-user apps
AppPropertiesValue
AppResourceHrefObject
AppServiceAccount
Credentials for a SaaS app account
AppServiceAccountForUpdate
The application user object defines a user's app-specific profile and credentials for an app
Indicates if the assignment is direct (`USER`) or by group membership (`GROUP`).
AppUserAssignRequest
Indicates if the assignment is direct (`USER`) or by group membership (`GROUP`).
Specifies a user's credentials for the app.
Updates the assigned user credentials
The user's password.
Updates the assigned user profile > **Note:** The Okta API currently doesn't support entity tags for
conditional updates.
Status of an application user
The synchronization state for the application user.
AppUserUpdateRequest
AssignedAppLink
AssignGroupOwnerRequestBody
AssignRoleRequest
AssignRoleToClient200Response
AssignRoleToClientRequest
Specify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard
role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role
type:
AssignRoleToGroup200Response
AssignRoleToGroupRequest
Specify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard
role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role
type:
AssignRoleToUser201Response
AssignRoleToUserRequest
Specify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard
role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role
type:
Action that assigns a user to a realm
AssociatedServerMediated
AssuranceMethod
Gets or Sets AssuranceMethodFactorMode
AttackProtectionAuthenticatorSettings
AttestationRootCertificatesRequestInner
AttestationRootCertificatesResponseInner
AuthenticationMethod
Indicates if any secrets or private keys used during authentication must be hardware protected and not
exportable.
Indicates if phishing-resistant Factors are required.
Indicates if a user is required to be verified with a verification method.
Gets or Sets userVerificationMethods
AuthenticationMethodChain
AuthenticationMethodChainMethod
AuthenticationMethodObject
Specifies the authentication provider that validates the user's password credential.
The type of authentication provider
The type of authentication provider
Specifies the authentication provider that validates the user password credential.
Enumeration that defines the available HTTP authentication schemes to be used when communicating with the Okta API server.
AuthenticatorBase
AuthenticatorEnrollment
AuthenticatorEnrollmentCreateRequest
AuthenticatorEnrollmentCreateRequestTac
AuthenticatorEnrollmentLinks
AuthenticatorEnrollmentPolicy
AuthenticatorEnrollmentPolicyAuthenticatorSettings
Constraints for the authenticator
Enrollment requirements for the authenticator
Requirements for the user-initiated enrollment
A label that identifies the authenticator
Specifies the conditions that must be met during policy evaluation to apply the policy
Identifies users and groups that are used together
Specifies a set of groups whose users are to be included or excluded
AuthenticatorEnrollmentPolicyRule
Specifies whether the user is to be enrolled the first time they `LOGIN`, the next time they are in the
`CHALLENGE` process, or `NEVER`
Gets or Sets self
AuthenticatorEnrollmentPolicyRuleActions
Specifies conditions that must be met during policy evaluation to apply the rule.
Identifies users and groups that are used together
Specifies a set of users to be included or excluded
Specifies the policy level settings > **Note:** In Identity Engine, the Multifactor (MFA) Enrollment policy name
has changed to authenticator enrollment policy.
Type of policy configuration object <x-lifecycle class=\"oie\"></x-lifecycle> The
`type` property in the policy `settings` is only applicable to the authenticator enrollment
policy available in Identity Engine.
Represents a particular authenticator serving as a constraint on a method
AuthenticatorKeyCustomApp
AuthenticatorKeyCustomAppAllOfProvider
Provider type
The configuration of the provider
AuthenticatorKeyCustomAppAllOfProviderConfigurationApns
AuthenticatorKeyCustomAppAllOfProviderConfigurationFcm
AuthenticatorKeyCustomAppAllOfSettings
AuthenticatorKeyDuo
AuthenticatorKeyDuoAllOfProvider
Provider type
AuthenticatorKeyDuoAllOfProviderConfiguration
AuthenticatorKeyDuoAllOfProviderConfigurationUserNameTemplate
AuthenticatorKeyEmail
AuthenticatorKeyEmailAllOfSettings
A human-readable string that identifies the authenticator
AuthenticatorKeyExternalIdp
AuthenticatorKeyGoogleOtp
AuthenticatorKeyOktaVerify
AuthenticatorKeyOktaVerifyAllOfSettings
AuthenticatorKeyOnprem
AuthenticatorKeyPassword
AuthenticatorKeyPhone
AuthenticatorKeyPhoneAllOfSettings
AuthenticatorKeySecurityKey
AuthenticatorKeySecurityQuestion
AuthenticatorKeySmartCard
AuthenticatorKeySymantecVip
AuthenticatorKeyTac
<x-lifecycle-container><x-lifecycle
class=\"oie\"></x-lifecycle></x-lifecycle-container>Settings for the TAC authenticator
Provider type
Define the configuration settings of the TAC
Define the complexity of the TAC
AuthenticatorKeyWebauthn
AuthenticatorKeyYubikey
AuthenticatorLinks
Gets or Sets AuthenticatorMethodAlgorithm
AuthenticatorMethodBase
Limits the authenticators that can be used for a given method.
Gets or Sets method
AuthenticatorMethodOtp
Gets or Sets AuthenticatorMethodProperty
AuthenticatorMethodPush
AuthenticatorMethodPushAllOfSettings
AuthenticatorMethodSignedNonce
AuthenticatorMethodSignedNonceAllOfSettings
AuthenticatorMethodSimple
AuthenticatorMethodTac
AuthenticatorMethodTotp
AuthenticatorMethodTotpAllOfSettings
Gets or Sets AuthenticatorMethodTransactionType
The type of authenticator method
The type of authenticator method
AuthenticatorMethodWebAuthn
The settings for the WebAuthn authenticator method
AuthenticatorMethodWithVerifiableProperties
Defines the authenticator specific parameters
Defines the authenticator specific parameters
Defines the authenticator specific parameters
AuthenticatorSimple
The type of authenticator
Enumeration that defines the mapping between available Authentication schemes and Authorization modes.
AuthorizationServer
AuthorizationServerCredentials
The Key rotation mode for the authorization server
AuthorizationServerCredentialsSigningConfig
How the key is used
AuthorizationServerJsonWebKey
AuthorizationServerPolicy
Specifies whether requests have access to this Policy
Indicates that the Policy is an authorization server Policy
AuthorizationServerPolicyAllOfLinks
AuthorizationServerPolicyConditions
Identifies Users and Groups that are used together
AuthorizationServerPolicyRule
Status of the rule
Rule type
AuthorizationServerPolicyRuleActions
AuthorizationServerPolicyRuleConditions
Specifies a set of Groups whose Users are to be included
AuthorizationServerPolicyRuleRequest
Status of the rule
Rule type
Specifies a set of Users to be included
AuthorizationServerResourceHrefObject
AuthServerLinks
AuthSettings
Gets or Sets AuthType
The org setting that automatically assigns the Okta Admin Console when an admin role is assigned
AutoLoginApplication
AutoLoginApplicationSettings
The entitlement management opt-in status for the app
AutoLoginApplicationSettingsSignOn
The schedule of auto-update configured by the admin
AvailableAction
AvailableActionProvider
AvailableActions
The destination AWS region where your event source is located
This object contains a number of sub-objects, each of which provide some type of contextual information.
Details of the user session
Identifies the Okta user that the token was generated to authenticate and provides details of their Okta user profile
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of the user.
BaseContextUserProfile
BaseEmailDomain
BaseEmailServer
BaseToken
The token
Lifetime of the token
BasicApplicationSettings
The entitlement management opt-in status for the app
BasicApplicationSettingsApplication
BasicAuthApplication
`template_basic_auth` is the key name for a Basic Authentication scheme app instance
BeforeScheduledActionPolicyRuleCondition
BehaviorRule
BehaviorRuleAnomalousDevice
BehaviorRuleAnomalousIP
BehaviorRuleAnomalousLocation
BehaviorRuleASN
BehaviorRuleSettingsAnomalousASN
BehaviorRuleSettingsAnomalousDevice
BehaviorRuleSettingsAnomalousIP
BehaviorRuleSettingsAnomalousLocation
BehaviorRuleSettingsHistoryBased
BehaviorRuleSettingsVelocity
Gets or Sets BehaviorRuleType
BehaviorRuleVelocity
The method used to bind the out-of-band channel with the primary channel.
BookmarkApplication
`bookmark` is the key name for a Bookmark app
BookmarkApplicationSettings
The entitlement management opt-in status for the app
BookmarkApplicationSettingsApplication
BouncesRemoveListError
BouncesRemoveListObj
BouncesRemoveListResult
Brand
Defines a list of domains with a subset of the properties for each domain
BrandRequest
BrandWithEmbedded
BrowserPluginApplication
The key name for the app definition
BulkDeleteRequestBody
The type of data to bulk delete in a session.
BulkGroupDeleteRequestBody
BulkGroupMembershipsDeleteRequestBody
BulkGroupMembershipsUpsertRequestBody
BulkGroupUpsertRequestBody
BulkGroupUpsertRequestBodyProfilesInner
BulkUpsertRequestBody
The type of data to upsert into the session.
BulkUpsertRequestBodyProfilesInner
An entitlement in a governance bundle
Link relations available
Entitlement list for a governance bundle
BundleEntitlementsResponseLinks
Link to the bundle resource
ByDateTimeAuthenticatorGracePeriodExpiry
An ISO 8601 formatted date and time for BY_DATE_TIME grace period type.
A time duration specified as an [ISO 8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations).
A Cache efficiently stores temporary objects primarily to improve an application's performance.
A Builder to specify configuration for
Cache regions.A CacheManager provides and maintains the lifecycle of
Cache instances.Builder for creating simple
CacheManager instances suitable for SINGLE-JVM APPLICATIONS.Static utility/helper factory methods for
building
CacheManagers and their associated cache regions, suitable for SINGLE-JVM APPLICATIONS.The credential was created, changed, revoked or deleted
The type of action done towards the credential
The credential type of the changed credential.
The entity that initiated the event
CaepCredentialChangeEventReasonAdmin
CaepCredentialChangeEventReasonUser
The subject's device compliance was revoked
Current device compliance status
The entity that initiated the event
Previous device compliance status
CaepDeviceComplianceChangeEventReasonAdmin
CaepDeviceComplianceChangeEventReasonUser
CaepEvent
CaepSecurityEvent
The entity that initiated the event
The session of the subject was revoked
The entity that initiated the event
Attempts to activate a `call` factor with the specified passcode
Verifies an OTP sent by a `call` factor challenge.
Determines whether Okta assigns a new app account to each user managed by Okta.
Defines user import rules
Rules for matching and creating users
Determines the attribute to match users
Defines import settings
Defines the configuration for the INBOUND_PROVISIONING feature
Defines the configurations for the USER_PROVISIONING feature
Determines whether updates to a user's profile are pushed to the app
Gets or Sets Capability
Capability type
The type of CAPTCHA provider
An app in the OIN catalog
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
App status
Gets or Sets ChallengeType
Determines whether a change in a user's password also updates the user's password in the app
ChangePasswordRequest
The out-of-band channel for use with authentication.
ChannelBinding
Gets or Sets style
ChildOrg
Edition for the org.
Status of the org.
Type of returned `token`.
Current version of the Chrome Browser
The type of user classification
Client
The
ClientBuilder is used to construct Client instances with Okta credentials,
Proxy and Cache configuration.Credentials to be used when authenticating requests to the Okta API server.
Specifies which clients are included in the Policy
The org setting that assigns the super admin role by default to a public client app
Static utility/helper class for working with
ApiClient resources.Gets or Sets CodeChallengeMethod
Compliance
Conditions of applying realm assignment
The signing key rotation setting for the provisioning connection
Type of connection authentication method
ContentSecurityPolicySetting
Gets or Sets mode
ContextPolicyRuleCondition
CreateAIAgentRequest
CreateBrandRequest
CreateGroupPushMappingRequest
CreateGroupRuleRequest
Gets or Sets type
CreateIamRoleRequest
CreateOrUpdatePolicy
CreateRealmAssignmentRequest
CreateRealmRequest
CreateResourceSetRequest
CreateSessionRequest
The request body properties for the new UI Schema
CreateUpdateIamRolePermissionRequest
CreateUserRequest
The ID of the user type.
CredentialSyncInfo
Current credential sync status of the privileged resource
Csr
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of a CSR object using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
CsrMetadata
CsrMetadataSubject
CsrMetadataSubjectAltNames
Describes allowed HTTP verbs for the `href`
Gets or Sets allow
Describes allowed HTTP verbs for the `href`
Gets or Sets allow
CustomAAGUIDCreateRequestObject
CustomAAGUIDResponseObject
CustomAAGUIDUpdateRequestObject
User verification setting
Custom authorization server for the managed connection
CustomAuthorizationServerLinks
Set of AIPs used for authType `CUSTOM`
CustomizablePage
CustomRole
CustomRoleAssignmentSchema
Specify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard
role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role
type:
DefaultApp
DesktopMFAEnforceNumberMatchingChallengeOrgSetting
DesktopMFARecoveryPinOrgSetting
A key object with public key details
Gets or Sets DetectedRiskEvents
Device
<x-lifecycle class=\"oie\"></x-lifecycle> Specifies the device condition to match on
DeviceAssurance
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>Represents the remediation mode
of this device assurance policy when users are denied access due to device noncompliance
DeviceAssuranceAndroidPlatform
DeviceAssuranceAndroidPlatformAllOfDiskEncryptionType
DeviceAssuranceAndroidPlatformAllOfScreenLockType
Settings for third-party signal providers (based on the `ANDROID` platform)
DeviceAssuranceChromeOSPlatform
Settings for third-party signal providers (based on the `CHROMEOS` platform)
DeviceAssuranceIOSPlatform
Settings for third-party signal providers (based on the `IOS` platform)
DeviceAssuranceMacOSPlatform
DeviceAssuranceMacOSPlatformAllOfDiskEncryptionType
Settings for third-party signal providers (based on the `MACOS` platform)
DeviceAssuranceWindowsPlatform
Settings for third-party signal providers (based on the `WINDOWS` platform)
DeviceContextProvider
Identifies the type of device context provider
Whether or not the device context provider is used to identify the user.
Display name of the device
DeviceIntegrations
The metadata of the device integration
Gets or Sets type
DeviceIntegrationsMetadataOneOf
Gets or Sets type
DeviceIntegrationsMetadataOneOf1
Gets or Sets type
DeviceIntegrationsMetadataOneOf2
Gets or Sets type
The namespace of the device integration
Gets or Sets DeviceIntegrationsPlatform
The status of the device integration
Indicates how well a device can enforce app integrity
DeviceList
List of associated users for the device if the `expand=user` query parameter is specified in the
request.
OS platform of the device
Gets or Sets DevicePolicyMDMFramework
Gets or Sets DevicePolicyPlatformType
DevicePolicyRuleCondition
Specifies [device assurance
policies](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/DeviceAssurance/) in the policy
rule
DevicePolicyRuleConditionPlatform
Gets or Sets DevicePolicyTrustLevel
DevicePostureCheck
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>Represents the Device Posture Checks
configuration for the device assurance policy
Represents how the device posture check is rendered in device assurance policies
Gets or Sets DevicePostureChecksPlatform
Represents the remediation instructions shown to the end user when the device posture check fails
DevicePostureChecksRemediationSettingsLink
DevicePostureChecksRemediationSettingsMessage
Gets or Sets DevicePostureChecksType
<x-lifecycle-container><x-lifecycle
class=\"oie\"></x-lifecycle></x-lifecycle-container>Device Posture IdP provider
DeviceProfile
DeviceSignalCollectionPolicy
DeviceSignalCollectionPolicyRule
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>Specifies actions to be taken, or
operations that may be allowed, if the rule conditions are satisfied
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>Specifies conditions that must be
met during policy evaluation to apply the rule.
Specifies how device context is collected when a user attempts to sign in
The state object of the device
DeviceUser
The management status of the device
Screen lock type of the device
Algorithm used to generate the key.
Gets or Sets DiskEncryptionTypeAndroid
Type of encryption used on the device > **Note:** The following values map to Disk Encryption ON:
`FULL`, `USER`, `ALL_INTERNAL_VOLUMES`.
Gets or Sets DiskEncryptionTypeDesktop
DNS TXT record that must be registered for an RP ID domain that requires verification.
DNS TXT and CNAME records to be registered for the Domain
Gets or Sets DNSRecordTypeAuthenticators
Gets or Sets DNSRecordTypeDomains
Defines the properties of the certificate
Certificate metadata for the domain
Certificate source type that indicates whether the certificate is provided by the user or Okta.
Certificate type
DomainLinks
Defines a list of domains with a subset of the properties for each domain
DomainRequest
The properties that define an individual domain.
Status of the domain
Status whether a domain has been failed over or not
Google Chrome Device Trust Connector provider
Google Chrome Device Trust Connector provider
Google Chrome Device Trust Connector provider
Duration
DynamicNetworkZone
The proxy type used for a Dynamic Network Zone
Elliptic curve key in JSON Web Key (JWK) format.
The elliptic curve protocol
The type of public key
The intended use for the key.
Attempts to activate an `email` factor with the specified passcode
Verifies an OTP sent by an `email` factor challenge.
EmailContent
EmailCustomization
EmailCustomizationAllOfLinks
EmailDefaultContent
EmailDomain
EmailDomainDNSRecord
Gets or Sets EmailDomainDNSRecordType
EmailDomainResponse
EmailDomainResponseWithEmbedded
Gets or Sets EmailDomainStatus
EmailPreview
EmailPreviewLinks
EmailServerPost
EmailServerRequest
EmailServerResponse
EmailSettings
Gets or Sets recipients
EmailSettingsResponse
Gets or Sets recipients
EmailSettingsResponseLinks
EmailTemplateResponse
EmailTemplateResponseEmbedded
EmailTemplateResponseLinks
Variant for email templates.
EmailTestAddresses
The Public Key Details are defined in the `_embedded` property of the Key object.
Gets or Sets enabledPagesType
Setting status
Requested authentication method for OAuth 2.0 endpoints.
Variant for the Okta End-User Dashboard.
EnhancedDynamicNetworkZone
The list of ASNs associated with an Enhanced Dynamic Network Zone
IP services, such as a proxy or VPN, to include or exclude for an Enhanced Dynamic Network Zone
The list of geolocations to include or exclude for an Enhanced Dynamic Network Zone
Enrollment Initialization Request
Name of the fulfillment provider for the WebAuthn preregistration factor
Enrollment initialization response
Name of the fulfillment provider for the WebAuthn preregistration factor
Enrollment initialization request
Name of the fulfillment provider for the WebAuthn preregistration factor
Yubico transport key in the form of a JSON Web Token (JWK), used to encrypt our fulfillment request to Yubico.
Name of the fulfillment provider for the WebAuthn preregistration factor
<x-lifecycle-container><x-lifecycle
class=\"oie\"></x-lifecycle></x-lifecycle-container>Specifies the time period required
to complete an authenticator enrollment or setup
Grace period type
Link to the entitlements resource
EntitlementTypesInner
Attributes for the entitlement type
The property mapping between an Okta entitlement and an app entitlement
EntitlementValue
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
EntitlementValuesResponse
EntitlementValuesResponseLinks
EntityRiskPolicy
EntityRiskPolicyRule
EntityRiskPolicyRuleActionRunWorkflow
Gets or Sets action
This action runs a workflow
EntityRiskPolicyRuleActionsObject
Gets or Sets action
EntityRiskPolicyRuleActionTerminateAllSessions
This action revokes or terminates all of the user's active sessions.
The action to take based on the risk event
The object that contains the `actions` array
EntityRiskPolicyRuleConditions
<x-lifecycle class=\"oie\"></x-lifecycle> The risk score level of the entity risk policy
rule
Gets or Sets level
Error
Conflict error object
ErrorCause
Details about an error that occurred during the operation
ErrorPage
Variant for the error page.
EventHook
Status of the event hook
EventHookChannel
EventHookChannelConfig
The authentication scheme used for this request.
The authentication scheme type.
EventHookChannelConfigHeader
The channel type.
EventHookFilterMapObject
EventHookFilterMapObjectCondition
The optional filter defined on a specific event type > **Note:** Event hook filters is a [self-service Early
Access (EA)](/openapi/okta-management/guides/release-lifecycle/#early-access-ea) to enable.
EventHookLinks
Verification status of the event hook.
EventSubscriptions
The events object type.
ExecuteInlineHook200Response
ExecuteInlineHookRequest
Conditional expression
FailbackRequestSchema
FailoverRequestSchema
FCMConfiguration
FCMPushProvider
Specifies feature release cycle information
Gets or Sets FeatureLifecycle
FeatureLinks
Link to feature dependencies
Link to feature dependents
Current release cycle stage of a feature If a feature's stage value is `EA`, the state is
`null` and not returned.
Indicates the release state of the feature
Current release stage of the feature
Type of feature
FederatedClaim
FederatedClaimRequestBody
Gets or Sets FipsEnum
ForgotPasswordResponse
Information about the fulfillment order that includes the factor’s make and model, the custom configuration of the
factor, and inventory details.
Fulfillment request
Name of the fulfillment provider for the WebAuthn preregistration factor
GetJwk200Response
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
GetSsfStreams200Response
The Subject Identifier format expected for any SET transmitted.
Schema for the Google Workspace app (key name: `google`) To create a Google Workspace app, use the [Create
an
Application](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
GoogleApplicationSettings
The entitlement management opt-in status for the app
Google app instance properties
GovernanceBundle
Request to create a governance bundle
Link relations available
GovernanceBundlesResponse
GovernanceBundlesResponseLinks
Request to update a governance bundle
The grant type
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>Represents the Grace Period
configuration for the device assurance policy
Represents the type of Grace Period configured for the device assurance policy
GracePeriodExpiry
Status
GrantResourcesHrefObject
Determines the mechanism Okta uses to authorize the creation of the tokens.
Array of grant types that this condition includes.
Group
Specifies a set of groups whose users are to be included or excluded
Embedded resources related to the group
If the group is sourced from an app, this object contains information about that app
Statistics about the group
[Discoverable
resources](/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!
GroupMembershipsRequestSchema
GroupMembershipsResponseSchema
GroupOwner
The source where group ownership is managed
The entity type of the owner
Specifies a set of groups whose users are to be included or excluded
Specifies required and optional properties for a group.
The object class type
GroupPushMapping
Discoverable resources related to the group push mapping
The status of the group push mapping
The status of the group push mapping
GroupRule
Defines which users and groups to assign
Defines group rule conditions
Defines Okta specific [group-rules
expression](https://developer.okta.com/docs/reference/okta-expression-language/#expressions-in-group-rules)
Contains the `groupIds` array
Currently not supported
Defines conditions for `people` in a group rule
Status of group rule.
Defines conditions specific to user exclusion
GroupSchema
GroupSchemaAttribute
GroupSchemaAttributeEnumInner
GroupSchemaBase
All Okta-defined profile properties are defined in a profile subschema with the resolution scope `#base`.
All custom profile properties are defined in a profile subschema with the resolution scope `#custom`
GroupSchemaDefinitions
Link to the [Application
Groups](/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments)
resource
GroupsRequestSchema
GroupsResponseSchema
The profile information of the group
Determines how a group's profile and memberships are managed
Link to the app help resource
The `id` property in the response as `id` serves as the unique ID for the key, which you can
specify when invoking other CRUD operations.
HostedPage
Gets or Sets HostedPageType
Link to publish CSR
Link to the resource (self)
Describes allowed HTTP verbs for the `href`
Describes allowed HTTP verbs and guidance for the `href`
HrefObject
Link to activate the resource
Link to the app resource
Link to the assignee resource
Link to authorize scopes
Link to the binding resource
Link to the bindings resource
Link to the client resource
Link to deactivate the resource
Link to delete the resource
Link to the resources
Link to grant Okta Aerial access to your Org
Link to the group resource
Link to the logo resource
Link to the mappings resource
Link to the member resource
Link to the members resource
Link to the next resource
Link to the permissions resource
Link to the resource set resource
Link to resource set resources
Link to retrieve Okta Aerial consent for your Org
Link to revoke Okta Aerial consent for your Org
Link to the role resource
Link to the rules resource
Link to the resource (self)
Link to suspend the resource
Link to unsuspend the resource
Link to the user resource
Gets or Sets HttpMethod
An entitlement in a governance bundle
IamRole
IamRoleLinks
IamRoles
Identity assertion connection for an app instance
Type of connection authentication method
The authentication protocol type used for the connection
Create an identity assertion connection for an app instance
Type of connection authentication method
The authentication protocol type used for the connection
Reference to an app instance in [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) format
Identity assertion connection for a custom authorization server
Type of connection authentication method
The authentication protocol type used for the connection
Create an identity assertion connection for a custom authorization server
Type of connection authentication method
The authentication protocol type used for the connection
Reference to a custom authorization server and its configuration
IdentityProvider
IdentityProviderApplicationUser
IdentityProviderApplicationUserLinks
Indicates whether Okta uses the original Okta org domain URL or a custom domain URL in the request to the social IdP
IdentityProviderLinks
Policy settings for the IdP.
Gets or Sets IdentityProviderPolicyProvider
Specifies the IdP that's used to sign in
The properties in the IdP `properties` object vary depending on the IdP type
Gets or Sets additionalAmr
Metadata about the IDV vendor.
IdP-specific protocol settings for endpoints, bindings, and algorithms used to connect with the IdP and validate
messages
SAML 2.0 protocol
The IdP object's `type` property identifies the social or enterprise IdP used for authentication.
IdentitySourceGroupMembershipsDeleteProfileInner
IdentitySourceGroupMembershipsUpsertProfileInner
Contains a set of external group attributes and their values that are mapped to Okta standard properties.
IdentitySourceSession
The current status of the identity source session
IdentitySourceUserProfileForDelete
Contains a set of external user attributes and their values that are mapped to Okta standard and custom profile
properties.
IdPCertificateCredential
Defines a CSR for a signature or decryption credential for an IdP
IdPCsrLinks
IdpDiscoveryPolicy
IdpDiscoveryPolicyRule
Specifies conditions that must be met during policy evaluation to apply the rule.
A [JSON Web Key](https://tools.ietf.org/html/rfc7517) for a signature or encryption credential for an IdP
Specifies where to route users when they are attempting to sign in to your org, if the rule conditions are satisfied.
Specifies IdP settings
IdpPolicyRuleActionMatchCriteria
IdpPolicyRuleActionProvider
IdProofingMethod
Determines whether the rule should use expression language or a specific IdP
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>JWE alg algorithm for encrypting the
ID token issued to this client.
IDV authorization endpoint
Gets or Sets binding
Credentials for verifying requests to the IDV vendor
Client credential for `IDV_PERSONA` IdP type
<x-lifecycle-container><x-lifecycle
class=\"oie\"></x-lifecycle></x-lifecycle-container>Client credentials for
`IDV_CLEAR` and `IDV_INCODE` IdP types
Contains endpoints for the IDV vendor.
IDV [PAR](https://datatracker.ietf.org/doc/html/rfc9126) endpoint
Gets or Sets binding
Token endpoint of the IDV vendor
Gets or Sets binding
Gets or Sets IframeEmbedScopeAllowedApps
ImageUploadResponse
Import schedule configuration
ImportScheduleSettings
Determines the Okta username for the imported user
Determines the username format when users sign in to Okta
InactivityPolicyRuleCondition
InboundProvisioningApplicationFeature
An inline hook object that specifies the details of the inline hook
InlineHookBasePayload
InlineHookChannel
Properties of the communications channel that are used to contact your external service
The authentication scheme to use for this request
The authentication scheme to use for this request
Properties of the communications channel that are used to contact your external service
InlineHookChannelConfigHeaders
InlineHookChannelCreate
InlineHookChannelHttp
InlineHookChannelHttpCreate
InlineHookChannelOAuth
InlineHookChannelOAuthCreate
Gets or Sets InlineHookChannelType
An inline hook object that specifies the details of the inline hook
An inline hook object that specifies the details of the inline hook
InlineHookHttpConfig
InlineHookHttpConfigCreate
InlineHookLinks
InlineHookLinksCreate
InlineHookOAuthBasicConfig
InlineHookOAuthChannelConfig
InlineHookOAuthChannelConfigCreate
InlineHookOAuthClientSecretConfig
InlineHookOAuthClientSecretConfigCreate
InlineHookOAuthPrivateKeyJwtConfig
An inline hook object that specifies the details of the inline hook
The API request that triggered the inline hook
The URL of the API endpoint
InlineHookResponse
InlineHookResponseCommands
InlineHookResponseCommandValue
Gets or Sets InlineHookStatus
One of the inline hook types
InlineObject
InlineObject1
InlineObject1ResultsInner
InlineObject2
InlineObjectResultsInner
InterclientTrustMapping
InterclientTrustMappingRequestBody
IPNetworkZone
An IP service offered by a provider, such as a proxy or VPN
Gets or Sets IssuerMode
Class that add parsing/formatting support for Java 8+
OffsetDateTime class.The update action
JsonWebKey
The status of the public key
The type of public key
The intended use of the public key
JwkUse
Purpose of the certificate.
KeepCurrent
<x-lifecycle-container><x-lifecycle
class=\"oie\"></x-lifecycle></x-lifecycle-container>Controls how often the
post-authentication prompt is presented to users
Whether the post-authentication [Keep Me Signed In
(KMSI)](https://help.okta.com/oie/en-us/content/topics/security/stay-signed-in.htm) flow is allowed
KeyRequest
Represents the attestation strength used by the Chrome Verified Access API
Represents the attestation strength used by the Chrome Verified Access API
KnowledgeConstraint
Gets or Sets methods
Gets or Sets types
Determines whether to update a user in the app when a user in Okta is updated
Determines whether deprovisioning occurs when the app is unassigned
LifecycleExpirationPolicyRuleCondition
Gets or Sets LifecycleStatus
LinkedHrefObject
LinkedObject
LinkedObjectDetails
The object type for this relationship
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LinksActivate
LinksAerialConsentGranted
LinksAerialConsentRevoked
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LinksAuthenticator
LinksCancel
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LinksDeactivate
LinksEnroll
LinksFactor
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the resources
using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)
specification.
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the sources using
the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)
specification.
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LinksPoll
LinksQrcode
LinksQuestions
LinksResend
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LinksSelfAndFullUsersLifecycle
LinksSelfAndLifecycle
LinksSelfAndRoles
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON
Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LinksSelfLifecycleAndAuthorize
LinksSend
LinksUserAuthenticators
LinksUserFactors
LinksUserRef
LinksVerify
ListGroupAssignedRoles200ResponseInner
ListJwk200ResponseInner
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
A collection of the profile mappings that include a subset of the profile mapping object's properties.
ListRolesForClient200ResponseInner
ListSubscriptionsRoleRoleRefParameter
Variant for the Okta loading page.
Gets or Sets LocationGranularity
Describes the user, app, client, or other entity (actor) who performs an action on a target.
All authentication relies on validating one or more credentials that prove the authenticity of the actor's
identity.
The system that proves the identity of an actor using the credentials provided to it
When an event is triggered by an HTTP request, the `client` object describes the
[client](https://datatracker.ietf.org/doc/html/rfc2616) that issues the HTTP request.
A credential provider is a software service that manages identities and their associated credentials.
The underlying technology/scheme used in the credential
For some kinds of events (for example, OLM provisioning, sign-in request, second factor SMS, and so on), the fields
that are provided in other response objects aren't sufficient to adequately describe the operations that the
event has performed.
The entity that describes a device enrolled with passwordless authentication using Okta Verify.
Gets or Sets LogDiskEncryptionType
LogEvent
Geographical context describes a set of geographic coordinates.
The latitude and longitude of the geolocation where an action was performed.
LogIpAddress
Describes the issuer of the authorization server when the authentication is performed through OAuth.
LogOutcome
Result of the action
The `Request` object describes details that are related to the HTTP request that triggers this event, if
available.
Gets or Sets LogScreenLockType
The `securityContext` object provides security information that is directly related to the evaluation of
the event's IP reputation.
Indicates how severe the event is
LogStream
Lifecycle status of the log stream object
Link to activate the resource
HTTP method allowed for the resource
LogStreamAws
LogStreamAwsPutSchema
Link to deactivate the resource
HTTP method allowed for the resource
LogStreamLinkObject
HTTP method allowed for the resource
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
LogStreamPutSchema
LogStreamSchema
Link to the resource (self)
HTTP method allowed for the resource
Specifies the configuration for the `aws_eventbridge` log stream type.
Specifies the configuration for the `splunk_cloud_logstreaming` log stream type.
Specifies the configuration for the `splunk_cloud_logstreaming` log stream type.
LogStreamSplunk
LogStreamSplunkPutSchema
Specifies the streaming provider used Supported providers: * `aws_eventbridge` ([AWS
EventBridge](https://aws.amazon.com/eventbridge)) * `splunk_cloud_logstreaming` ([Splunk
Cloud](https://www.splunk.com/en_us/software/splunk-cloud-platform.html)) Select the provider type to see
provider-specific configurations in the `settings` property:
LogTarget
Details on the target's changes.
A `transaction` object comprises contextual information associated with its respective event.
\"A user agent is software (a software agent) that is acting on behalf of a user
ManagedConnection
Type of connection authentication method
The authentication protocol type used for the connection
App instance for the managed connection
Create a new connection
Type of connection authentication method
The authentication protocol type used for the connection
ManagedConnectionList
Links available in managed list response
Update an existing managed connection.
Determines how Okta evaluates requested scopes for the connection.
Service account for the managed connection
The status of the connection
Secret for the managed connection
Gets or Sets MDMEnrollmentPolicyEnrollment
MDMEnrollmentPolicyRuleCondition
MembershipRequestSchema
Link to the [SAML
metadata](/openapi/okta-management/management/tag/ApplicationSSO/#tag/ApplicationSSO/operation/previewSAMLmetadataForApplication)
for SSO
Certificate chain description for verifying assertions from the Smart Card
MtlsEndpoints
The Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService` endpoint
MtlsTrustCredentials
Mechanism to validate the certificate > **Note:** This property isn't supported.
Utility class to detect and warn about multi-threaded usage of the Okta SDK.
NetworkZone
Specifies the value of an IP address expressed using either `range` or `CIDR` form.
Format of the IP addresses
NetworkZoneLocation
Network Zone status
The type of Network Zone
The usage of the Network Zone
The type of notification
Contains the `challenge` and `correctAnswer` objects for `push` factors that use a
number matching challenge
Number matching challenge for a `push` factor
User that created the object
OAuth2Claim
Specifies the scopes for the Claim
Specifies the type of group filter if `valueType` is `GROUPS` If `valueType` is
`GROUPS`, then the groups returned are filtered according to the value of `group_filter_type`.
Specifies whether the Claim is for an access token (`RESOURCE`) or an ID token (`IDENTITY`)
Specifies whether the Claim is an Okta Expression Language (EL) expression (`EXPRESSION`), a set of groups
(`GROUPS`), or a system claim (`SYSTEM`)
OAuth2Client
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>A [JSON Web Key
(JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>A [JSON Web Key
(JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.
Cryptographic algorithm family for the certificate's key pair
Status of the OAuth 2.0 client JSON Web Key
Acceptable use of the JSON Web Key
An EC signing key
The cryptographic curve used with the key
An EC signing key
The cryptographic curve used with the key
OAuth2ClientJsonWebKeyRequestBase
Status of the OAuth 2.0 client JSON Web Key
OAuth2ClientJsonWebKeyRequestBody
Status of the OAuth 2.0 Client JSON Web Key
OAuth2ClientJsonWebKeyResponseBase
An RSA signing key
An RSA signing key
OAuth2ClientLinks
OAuth2ClientSecret
Status of the OAuth 2.0 Client Secret
OAuth2ClientSecretRequestBody
Status of the OAuth 2.0 Client Secret
OAuth2RefreshToken
The embedded resources related to the object if the `expand` query parameter is specified
OAuth2RefreshTokenLinks
Link to revoke the refresh Token
OAuth2RefreshTokenLinksAllOfRevokeAllOfHints
Gets or Sets allow
OAuth2RefreshTokenScope
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
OAuth2ResourceServerJsonWebKey
The status of the encryption key.
OAuth2ResourceServerJsonWebKeyRequestBody
Status of the JSON Web Key
OAuth2Scope
Grant object that represents an app consent scope grant
Embedded resources related to the Grant
OAuth2ScopeConsentGrantEmbeddedScope
OAuth2ScopeConsentGrantLinks
User type source that granted consent
Indicates whether a consent dialog is needed for the Scope
Indicates whether the Scope is included in the metadata
Array of scopes that the condition includes
OAuth 2.0 configuration used for authType `OAUTH2`
OAuth2Token
OAuthApplicationCredentials
Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18)
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of an application using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
Client authentication credentials for an [OAuth 2.0 Authorization
Server](https://tools.ietf.org/html/rfc6749#section-2.3)
OAuth 2.0 and OpenID Connect Client object > **Note:** You must complete client registration with the IdP
Authorization Server for your Okta IdP instance to obtain client credentials.
Client authentication methods supported by the token endpoint
Requested authentication method for the token endpoint
The `OAUTH2` and `OIDC` protocols support the `authorization` and `token`
endpoints.
OAuth flows that are supported by this client
OAuthMetadata
Gets or Sets dpopSigningAlgValuesSupported
Application name for the provisioning connection
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status
of a JSON Web Key using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.
Array of OAuth 2.0 response type strings
Endpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18)
Schema for the Microsoft Office 365 app (key name: `office365`) To create a Microsoft Office 365 app, use
the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
Office365ApplicationSettings
The entitlement management opt-in status for the app
Office365 app instance properties
Settings required for the Microsoft Office 365 provisioning connection
OfflineAccessScopeResourceHrefObject
OIDC configuration details
OidcAlgorithms
Endpoint for the JSON Web Key Set (JWKS) document.
Algorithm settings used to sign an authorization request
Signature Algorithm settings for signing authorization requests sent to the IdP > **Note:** The
`algorithm` property is ignored when you disable request signatures (`scope` set as
`NONE`).
Advanced settings for the OpenID Connect protocol
Gets or Sets OidcSigningAlgorithm
OIDC IdP logout endpoint
Endpoint for getting identity information about the user.
OINApplication
Contains SAML 1.1 sign-on mode attributes
Contains SAML 2.0 sign-on mode attributes.
Profile for a group that is imported from Active Directory.
The object class type
The device risk level changed
Current risk level of the device
The entity that initiated the event
Previous risk level of the device
IP changed for the subject's session
The entity that initiated the event
Defines a list of Okta Personal settings that can be enabled or disabled for the org
OktaSignOnPolicy
OktaSignOnPolicyConditions
Indicates if the User should be challenged for a second factor (MFA) based on the device being used, a Factor session
lifetime, or on every sign-in attempt > **Note:** Required only if `requireFactor` is set to
`true`.
OktaSignOnPolicyRule
OktaSignOnPolicyRuleActions
OktaSignOnPolicyRuleConditions
Specifies settings for the policy rule
Indicates if a user is allowed to sign in
<x-lifecycle class=\"oie\"></x-lifecycle> Indicates the primary factor used to establish a
session for the org.
Properties governing the user's session lifetime
Status of Okta Support access
OktaSupportCase
Allows the Okta Support team to sign in to your org as an admin and troubleshoot issues
OktaSupportCases
Customer allows Okta Support access to self-assigned cases.
Profile for any group that is not imported from Active Directory.
The object class type
The user risk level changed
Current risk level of the user
The entity that initiated the event
Previous risk level of the user
Credentials for an Okta user
OpenIdConnectApplication
`oidc_client` is the key name for an OAuth 2.0 client app instance
Indicates whether user consent is required or implicit.
The type of IdP-initiated sign-in flow that the client supports
The mode to use for the IdP-initiated sign-in flow.
Indicates whether the Okta authorization server uses the original Okta org domain URL or a custom domain URL as the
issuer of the ID token for this client
The network restrictions of the client
The connection type of the network.
OpenIdConnectApplicationSettings
The entitlement management opt-in status for the app
OpenIdConnectApplicationSettingsClient
The signing algorithm for Client-Initiated Backchannel Authentication (CIBA) signed requests using JWT.
The delivery mode for Client-Initiated Backchannel Authentication (CIBA).
The type of JSON Web Key Set (JWKS) algorithm that must be used for signing request objects
Type of the subject
Indicates if the client is allowed to use wildcard matching of `redirect_uris`
A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for validating JWTs presented to Okta or for
encrypting ID tokens minted by Okta for the client
Refresh token configuration for an OAuth 2.0 client When you create or update an OAuth 2.0 client, you can configure
refresh token rotation by setting the `rotation_type` and `leeway` properties.
The type of client app Specific `grant_types` are valid for each `application_type`.
The refresh token rotation mode for the OAuth 2.0 client
Operational status of a given agent
OperationRequest
OperationResponse
The status of the asynchronous operation
OptInStatusResponse
The entitlement management opt-in status for the Admin Console
Link relations available
Schema for the Okta Org2Org app (key name: `okta_org2org`) To create an Org2Org app, use the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
Org2OrgApplicationSettings
The entitlement management opt-in status for the app
Org2Org app instance properties
Only used for the Okta Org2Org (`okta_org2org`) app.
OrgAerialConsent
OrgAerialConsentDetails
OrgAerialConsentRevoked
OrgAerialGrantNotFound
OrganizationalUnit
Org billing contact
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org billing
contact type object using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
Link relations for the CAPTCHA settings object
Type of contact
OrgContactTypeObj
OrgContactUser
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the contact type
user object using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
Profile and credential information for the first super admin user of the child org.
Specifies primary authentication and recovery credentials for a user.
Specifies a password for a user > **Note:** For information on defaults and configuring your password policies,
see [Configure the password
authenticator](https://help.okta.com/okta_help.htm?
Specifies the profile attributes for the first super admin user.
Connection object for Cross App Access connections
Indicates if the Cross App Access connection is active or inactive
Patch request object for Cross App Access Connections
Requested value of Cross App Access connection status
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org using the
[JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
OrgOktaCommunicationSetting
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using
the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)
specification
Status of Okta Support Settings
OrgOktaSupportSettingsObj
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the Okta Support
Settings object using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
OrgPreferences
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using
the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)
specification
OrgSetting
Status of org
Org technical contact
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org technical
Contact Type object using the [JSON Hypertext Application
Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification
Specifies the OS requirement for the policy.
OSVersionConstraint
Indicates the Windows major version
Contains the necessary properties for a dynamic Windows version requirement
Indicates the type of the dynamic Windows version requirement
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>Contains the necessary properties
for a dynamic version requirement
Indicates the type of the dynamic OS version requirement
Current version of the operating system (maximum of four components in the versioning scheme)
Current version of the operating system (maximum of three components in the versioning scheme)
The protocol used
HMAC algorithm
The shared secret encoding
A new lazy, paginated iterable.
The new stateful, but *isolated*, iterator for pagination.
Deprecated.
PageRoot
PageRootEmbedded
PageRootLinks
Helper class for Pagination related functions.
Attributes used for processing Active Directory group membership update
The update action to take
Specifies a password for a user.
Specifies a hashed password to import into Okta.
The algorithm used to generate the hash using the password (and salt, when applicable).
Specify a [password import inline
hook](/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook) to
trigger verification of the user's password the first time the user signs in.
Weak password dictionary lookup settings
Lookup settings for commonly used passwords
PasswordExpirationPolicyRuleCondition
PasswordImportRequest
PasswordImportRequestData
This object specifies the default action Okta is set to take.
PasswordImportRequestDataContext
PasswordImportRequestDataContextCredential
Password import inline hook request
Password import inline hook response
PasswordImportResponseCommandsInner
The parameter value of the command. * To indicate that the supplied credentials are valid, supply a type property set
to `com.okta.action.update` together with a value property set to `{\"credential\":
\"VERIFIED\"}`. * To indicate that the supplied credentials are invalid, supply a type property set to
`com.okta.action.update` together with a value property set to `{\"credential\":
\"UNVERIFIED\"}`.
Gets or Sets credential
PasswordPolicy
Specifies an authentication provider that's the source of some or all users
Gets or Sets PasswordPolicyAuthenticationProviderType
Specifies the conditions that must be met during policy evaluation to apply the policy
Specifies how to handle password delegation
PasswordPolicyDelegationSettingsOptions
Specifies the password settings for the policy
Age settings
Breached Protection settings
Complexity settings
Lockout settings
PasswordPolicyRecoveryEmail
PasswordPolicyRecoveryEmailProperties
PasswordPolicyRecoveryEmailRecoveryToken
Settings for the factors that can be used for recovery
PasswordPolicyRecoveryFactorSettings
PasswordPolicyRecoveryQuestion
PasswordPolicyRecoveryQuestionComplexity
PasswordPolicyRecoveryQuestionProperties
Specifies the password recovery settings for the policy > **Note:** With Identity Engine, you can specify recovery
factors inside the password policy rule instead of in the policy settings object.
PasswordPolicyRule
Indicates if a password can be changed
PasswordPolicyRuleActions
Specifies conditions that must be met during policy evaluation to apply the rule.
Specifies the policy level settings
Indicates whether the Password Protection Warning feature is enabled
Determines whether Okta creates and pushes a password in the app for each assigned user
The operation (PATCH action)
Partial update for AI agent profile
JSON Merge Patch for AI agent.
Gets or Sets PerClientRateLimitMode
A map of Per-Client Rate Limit Use Case to the applicable PerClientRateLimitMode.
Permission
Conditions for further restricting a permission.
PermissionLinks
Permissions assigned to the role
Defines a list of email domains with a subset of the properties for each domain
Pin request
Name of the fulfillment provider for the WebAuthn preregistration factor
The Okta authentication pipeline of the org
Gets or Sets Platform
PlatformConditionEvaluatorPlatform
PlatformConditionEvaluatorPlatformOperatingSystem
PlatformConditionEvaluatorPlatformOperatingSystemVersion
Gets or Sets PlatformConditionOperatingSystemVersionMatchType
Specifies a particular platform or device to match on
Indicates if Google Play Protect is enabled on the device and whether it has found known malware
Policy
Gets or Sets PolicyAccess
Specifies the behavior for linking an IdP user to an existing Okta user
Specifies the account linking action for an IdP user
Specifies filters on which users are available for account linking by an IdP
Group memberships used to determine link candidates
Filters on which users are available for account linking
PolicyCommon
PolicyContext
PolicyContextDevice
An array of Group IDs for the simulate operation.
The risk rule condition level
Gets or Sets level
The user ID for the simulate operation.
The zone ID under the network rule condition.
PolicyLinks
PolicyMapping
PolicyMappingLinks
PolicyMappingRequest
Specifies the type of resource to map.
Specifies a network selection mode and a set of network zones to be included or excluded.
Network selection mode
Identifies users and groups that are used together
Gets or Sets PolicyPlatformOperatingSystemType
Gets or Sets PolicyPlatformType
PolicyRule
PolicyRuleActionsEnroll
Gets or Sets PolicyRuleActionsEnrollSelf
Specifies an authentication entry point
Specifies how the user is authenticated
PolicyRuleConditions
Rule type
Verification method type
Specifies the behavior for establishing, validating, and matching a username for an IdP user
Determines the Okta user profile attribute match conditions for account linking and authentication of the transformed
IdP username
All Okta orgs contain only one IdP discovery policy with an immutable default rule routing to your org's sign-in
page, one entity risk policy, and one session protection policy.
Gets or Sets PolicyTypeSimulation
[Okta Expression Language (EL) expression](https://developer.okta.com/docs/reference/okta-expression-language/) to
generate or transform a unique username for the IdP user. * IdP user profile attributes can be referenced with the
`idpuser` prefix such as `idpuser.subjectNameId`. * You must define an IdP user profile attribute
before it can be referenced in an Okta EL expression.
Gets or Sets PolicyUserStatus
PossessionConstraint
Indicates if device-bound Factors are required.
Indicates if any secrets or private keys used during authentication must be hardware protected and not
exportable.
Gets or Sets methods
Indicates if phishing-resistant Factors are required.
Gets or Sets types
Indicates if the user needs to approve an Okta Verify prompt or provide biometrics (meets NIST AAL2
requirements).
Indicates the user interaction requirement (PIN or biometrics) to ensure verification of a possession factor
Gets or Sets userVerificationMethods
PostAPIServiceIntegrationInstance
PostAPIServiceIntegrationInstanceRequest
PostAuthKeepMeSignedInPrompt
PostAuthSessionFailureActionsObject
Gets or Sets action
PostAuthSessionPolicy
PostAuthSessionPolicyRule
The action to take in response to a failure of the reevaluated global session policy or authentication polices
This object contains a `failureActions` array that defines the specific action to take when the session
protection policy detects a failure
Specifies conditions that must be met during policy evaluation to apply the rule.
PostAuthSessionPolicyRuleRunWorkflow
Gets or Sets action
PostAuthSessionPolicyRuleTerminateSession
The action to take when the session protection policy detects a failure.
PotentialConnection
Type of connection authentication method
The authentication protocol type used for the connection
PotentialConnectionList
Links available for the potential connection list
PreRegistrationInlineHook
The type of principal, either an API token or an OAuth 2.0 app
Base class for PrivilegedResourceRequest and PrivilegedResourceResponse
PrivilegedResourceAccountAppRequest
PrivilegedResourceAccountAppResponse
PrivilegedResourceAccountOkta
Credentials for the privileged resource
PrivilegedResourceFilters
Current status of the privileged resource
The type of the resource
Update request for a privileged resource
ProfileEnrollmentPolicy
ProfileEnrollmentPolicyRule
ProfileEnrollmentPolicyRuleAction
Indicates if the user profile is granted access > **Note:** You can't set the `access` property
to `DENY` after you create the policy
Progressive profile enrollment helps evaluate the user profile policy at every user login.
Which action should be taken if this user is new
ProfileEnrollmentPolicyRuleActions
Contains a single Boolean property that indicates whether `emailVerification` should occur
(`true`) or not (`false`, default)
ProfileEnrollmentPolicyRuleProfileAttribute
The profile mapping object describes a mapping between an Okta user's and an app user's properties using
[JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04).
A target property, in string form, that maps to a valid [JSON Schema
Draft](https://tools.ietf.org/html/draft-zyp-json-schema-04) document.
Indicates whether to update target properties for user create and update or just for user create. - Having a
pushStatus of `PUSH` causes properties in the target to be updated on create and update. - Having a
pushStatus of `DONT_PUSH` causes properties in the target to be updated only on create.
The updated request body properties
The parameter is the source of a profile mapping and is a valid [JSON Schema Draft
4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04) document with the following properties.
The parameter is the target of a profile mapping and is a valid [JSON Schema Draft
4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04) document with the following properties.
This setting determines whether a user in the app gets updated when they're updated in Okta.
Gets or Sets Protocol
Specifies whether to digitally sign authorization requests to the IdP
Specifies whether to verify responses from the IdP
Gets or Sets ProtocolEndpointBinding
Protocol settings for the IDV vendor
ID verification protocol
Protocol settings for the [MTLS Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4)
Mutual TLS
Protocol settings for authentication using the [OAuth 2.0 Authorization Code
flow](https://tools.ietf.org/html/rfc6749#section-4.1)
OAuth 2.0 Authorization Code flow
Protocol settings for authentication using the [OpenID Connect
Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth)
OpenID Connect Authorization Code flow
Protocol settings for the [SAML 2.0 Authentication Request
Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf)
SAML 2.0 protocol
The authentication protocol type used for the connection
Gets or Sets ProviderType
Specifies the behavior for just-in-time (JIT) provisioning of an IdP user as a new Okta user and their group
memberships
Specifies the user provisioning action during authentication when an IdP user isn't linked to an existing Okta
user. * To successfully provision a new Okta user, you must enable just-in-time (JIT) provisioning in your org
security settings. * If the target username isn't unique or the resulting Okta user profile is missing a required
profile attribute, JIT provisioning may fail. * New Okta users are provisioned with either a `FEDERATION`
or `SOCIAL` authentication provider depending on the IdP type.
Conditional behaviors for an IdP user during authentication
Defines the method of authentication
OAuth 2.0 is used to authenticate with the app.
ProvisioningConnectionOauthRequest
ProvisioningConnectionOauthRequestProfile
The app provisioning connection profile used to configure the method of authentication and the credentials.
Gets or Sets ProvisioningConnectionRequestAuthScheme
ProvisioningConnectionResponse
ProvisioningConnectionResponseProfile
Provisioning connection status
A token is used to authenticate with the app.
ProvisioningConnectionTokenRequest
ProvisioningConnectionTokenRequestProfile
Specifies the action during authentication when an IdP user is linked to a previously deprovisioned Okta user
Behavior for a previously deprovisioned IdP user during authentication.
Supported provisioning configurations for your integration
Feature
Provisioning settings for a user's group memberships
Provisioning action for the IdP user's group memberships | Enum | Description | Existing OKTA_GROUP Memberships |
Existing APP_GROUP Memberships | Existing BUILT_IN Memberships | | -------- |
-----------------------------------------------------------------------------------------------------------------------------------------------------------------
| ----------------------------------------------------------------------------------------------------- |
------------------------------ | ----------------------------- | | `APPEND` | Adds a user to any group
defined by the IdP as a value of the `sourceAttributeName` array that matches the name of the allow listed
group defined in the `filter` | Unchanged | Unchanged | Unchanged | | `ASSIGN` | Assigns a user
to groups defined in the `assignments` array | Unchanged | Unchanged | Unchanged | | `NONE` |
Skips processing of group memberships | Unchanged | Unchanged | Unchanged | | `SYNC` | Group memberships
are sourced by the IdP as a value of the `sourceAttributeName` array that matches the name of the group
defined in the `filter` | Removed if not defined by the IdP in `sourceAttributeName` and matching
name of the group in `filter` | Unchanged | Unchanged | > **Note:** Group provisioning action is
processed independently from profile sourcing.
Specifies the action during authentication when an IdP user is linked to a previously suspended Okta user
Behavior for a previously suspended IdP user during authentication.
Sends an asynchronous push notification to the device for approval by the user.
Sends an asynchronous push notification to the device for approval by the user.
Indicates whether you must use a hardware key store
PushProvider
Verifies an answer to a `question` factor
Realm
RealmAssignment
RealmAssignmentOperationResponse
The status of the asynchronous operation
Definition of the realm assignment operation
Configuration defintion of the realm
Realm assignment action
Action that assigns a user to a realm
RealmProfile
Used to store partner users.
Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or
unlocks their account.
The refresh token
RegistrationInlineHook
RegistrationInlineHookCommand
Gets or Sets type
RegistrationInlineHookPPData
RegistrationInlineHookPPDataAllOfData
RegistrationInlineHookPPDataAllOfDataContext
RegistrationInlineHookPPDataAllOfDataContextUser
Registration inline hook request
The type of registration hook.
Registration inline hook response
RegistrationInlineHookSSRData
RegistrationInlineHookSSRDataAllOfData
RegistrationInlineHookSSRDataAllOfDataContext
RegistrationResponse
RegistrationResponseCommandsInner
For the registration inline hook, the `error` object provides a way of displaying an error message to the
end user who is trying to register or update their profile. * If you're using the Okta Sign-In Widget for Profile
Enrollment, only the `errorSummary` messages of the `errorCauses` objects that your external
service returns appear as inline errors, given the following: * You don't customize the error handling behavior
of the widget. * The `location` of `errorSummary` in the `errorCauses` object specifies
the request object's user profile attribute. * If you don't return a value for the `errorCauses`
object, and deny the user's registration attempt through the `commands` object in your response to
Okta, one of the following generic messages appears to the end user: * \"Registration cannot be completed at
this time
RegistrationResponseErrorErrorCausesInner
Release channel for auto-update
ReplaceUserClassification
Gets or Sets RequiredEnum
ResendUserFactor
Type of the factor
ResetPasswordToken
Conditions for further restricting a resource.
Specific resources to exclude
A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.
<x-lifecycle-container><x-lifecycle
class=\"ea\"></x-lifecycle></x-lifecycle-container>A [JSON Web Key
Set](https://tools.ietf.org/html/rfc7517#section-5) for encrypting JWTs minted by the custom authorization server
ResourceSet
ResourceSetBindingAddMembersRequest
ResourceSetBindingCreateRequest
ResourceSetBindingEditResponse
ResourceSetBindingEditResponseLinks
ResourceSetBindingMember
ResourceSetBindingMembers
ResourceSetBindingMembersLinks
ResourceSetBindingResponse
ResourceSetBindingResponseLinks
ResourceSetBindingRole
ResourceSetBindingRoleLinks
ResourceSetBindings
ResourceSetBindingsLinks
ResourceSetLinks
ResourceSetResource
Related discoverable resources
ResourceSetResourcePatchRequest
ResourceSetResourcePostRequest
ResourceSetResourcePutRequest
ResourceSetResources
ResourceSetResourcesLinks
ResourceSets
Link objects
Gets or Sets ResponseMode
Gets or Sets ResponseType
Gets or Sets ResponseTypesSupported
RevokeRefreshTokenHrefObject
The subject's identifier has changed, which is either an email address or a phone number change
<x-lifecycle class=\"oie\"></x-lifecycle> An object that references detected risk events.
RiskEvent
RiskEventSubject
The risk level associated with the IP
RiskPolicyRuleCondition
RiskProvider
Action taken by Okta during authentication attempts based on the risk events sent by this provider
Specifies a particular level of risk to match on
The level to match
Role
RoleAssignedUser
RoleAssignedUsers
Role assignment type
List of all user role governance sources
The resource of a grant
The resources of a grant
User role governance source
RoleGovernanceSourceLinks
RoleTarget
| Role type | Description |
|------------------------------|-------------------------------------------------------------| |
ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | | ACCESS_REQUESTS_ADMIN |
Access Requests Administrator IAM-based standard role | | API_ACCESS_MANAGEMENT_ADMIN | Access Management
Administrator standard role | | APP_ADMIN | Application Administrator standard role | | CUSTOM | Custom admin role |
| GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | | HELP_DESK_ADMIN | Help Desk Administrator
standard role | | ORG_ADMIN | Organizational Administrator standard role | | READ_ONLY_ADMIN | Read-Only
Administrator standard role | | REPORT_ADMIN | Report Administrator standard role | | SUPER_ADMIN | Super
Administrator standard role | | USER_ADMIN | User Administrator standard role | | WORKFLOWS_ADMIN | Workflows
Administrator IAM-based standard role |
Rotate password request for the privileged resource
Represents the current value of the Safe Browsing protection level
Schema for the Salesforce app (key name: `salesforce`) To create a Salesforce app, use the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
SalesforceApplicationSettings
The entitlement management opt-in status for the app
Salesforce app instance properties
Salesforce instance that you want to connect to
Salesforce integration type
SAML configuration details
Saml11Application
Saml11ApplicationSettings
The entitlement management opt-in status for the app
SAML 1.1 sign-on mode attributes
Okta's `SPSSODescriptor` endpoint where the IdP sends a `<SAMLResponse>` message
SamlAcsInner
Settings for signing and verifying SAML messages
SamlApplication
SamlApplicationSettings
The entitlement management opt-in status for the app
SAML 2.0 sign-on attributes.
Identifies the SAML authentication context class for the assertion's authentication statement
Determines the digest algorithm used to digitally sign the SAML assertion and response
Determines the signing algorithm used to digitally sign the SAML assertion and response
Identifies the SAML processing rules.
Determines if the app supports encrypted assertions
The encryption algorithm used to encrypt the SAML assertion
The key transport algorithm used to encrypt the SAML assertion
SamlAttributeStatement
The operation to filter groups based on `filterValue`
The name format of the group attribute.
The type of attribute statements object
Generic `EXPRESSION` attribute statements
The name format of the attribute.
The type of attribute statements object
`GROUP` attribute statements
The operation to filter groups based on `filterValue`
The name format of the group attribute.
The type of attribute statements object
SamlClaimsInner
Federation Trust Credentials for verifying assertions from the IdP and signing requests to the IdP
SAML 2.0 HTTP binding settings for IdP and SP (Okta)
Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadata
SAMLHookResponse
SAMLHookResponseCommandsInner
SAMLHookResponseCommandsInnerValueInner
The value of the claim that you add or replace, and can also include other attributes.
An object to return an error.
SAML 2.0 Name Identifier formats
SAMLPayLoad
SAMLPayLoadData
Details of the SAML assertion that was generated
Provides a JSON representation of the `<saml:AuthnStatement>` element of the SAML assertion
Details of the authentication methods used for the SAML assertion
SAMLPayLoadDataAssertionClaimsValue
SAMLPayLoadDataAssertionClaimsValueAttributes
SAMLPayLoadDataAssertionClaimsValueAttributeValuesInner
SAMLPayLoadDataAssertionClaimsValueAttributeValuesInnerAttributes
Provides a JSON representation of the `<saml:Conditions>` element of the SAML assertion
Specifies the expiration time, in seconds, of the SAML assertion
Provides a JSON representation of the `<saml:Subject>` element of the SAML assertion
SAMLPayLoadDataAssertionSubjectConfirmation
SAMLPayLoadDataAssertionSubjectConfirmationData
SAMLPayLoadDataContext
Details of the assertion protocol being used
SAMLPayLoadDataContextAllOfProtocolIssuer
SAML assertion inline hook request
Relay state settings for IdP
The format used to generate the `relayState` in the SAML request.
Algorithm settings used to secure an `<AuthnRequest>` message
XML digital Signature Algorithm settings for signing `<AuthnRequest>` messages sent to the IdP >
**Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as
`NONE`).
Algorithm settings for verifying `<SAMLResponse>` messages and `<Assertion>` elements
from the IdP
XML digital Signature Algorithm settings for verifying `<SAMLResponse>` messages and
`<Assertion>` elements from the IdP
Advanced settings for the SAML 2.0 protocol
Gets or Sets SamlSigningAlgorithm
Key used for signing requests to the IdP
IdP's `SingleLogoutService` endpoint where Okta sends a `<LogoutRequest>` message
The certificate that Okta uses to validate Single Logout (SLO) requests and responses
IdP's `SingleSignOnService` endpoint where Okta sends an `<AuthnRequest>` message
Federation Trust Credentials for verifying assertions from the IdP
ScheduledUserLifecycleAction
SchemeApplicationCredentials
SCIM configuration details
SCIM server schema configuration
Password change options
PATCH operation options
Determines how Okta evaluates requested scopes for the connection.
ScopeResourceHrefObject
Indicates whether a device has a screen lock set, and the type or complexity of the screen lock **Note:** This option
requires a `screenLockType.include` value.
Gets or Sets ScreenLockType
SecurePasswordStoreApplication
`template_sps` is the key name for a SWA app instance that uses HTTP POST and doesn't require a
browser plugin
SecurePasswordStoreApplicationSettings
The entitlement management opt-in status for the app
SecurePasswordStoreApplicationSettingsApplication
SecurityEvent
SecurityEventReason
The request schema for creating or updating a Security Events Provider.
Information about the Security Events Provider for signal ingestion
The Security Events Provider response
Indicates whether the Security Events Provider is active or not
Security Events Provider with issuer and JWKS settings for signal ingestion
Security Events Provider settings
Security Events Provider with well-known URL setting
The event subjects
Error object thrown when parsing the Security Event Token
A code that describes the category of the error
JSON Web Token body payload for a Security Event Token sent by the SSF Transmitter.
A non-empty set of events.
JSON Web Token header for a Security Event Token sent by the SSF Transmitter
JSON Web Token body payload for a Security Event Token
A non-empty collection of events
JSON Web Token header for a Security Event Token
Determines whether the generated password is the user's Okta password or a randomly generated password
Okta Support access approval status for self-assigned cases
Enables or disables users to reset their own password and defines the authenticators and constraints needed to
complete the reset
<x-lifecycle class=\"oie\"></x-lifecycle> The type of rule action
Representing a Server configuration.
Representing a Server Variable for server URL template substitution.
ServiceAccount
Details for a SaaS app account, which will be managed as a service account
Details for a SaaS app account, which will be managed as a service account
Details for managing an Okta user as a service account
Details for managing an Okta user as a service account
ServiceAccountForUpdate
Describes the current status of an app service account
Describes the detailed status of an app service account
The type of service account
Session
Gets or Sets SessionAuthenticationMethod
SessionIdentityProvider
Gets or Sets SessionIdentityProviderType
Gets or Sets SessionStatus
Controls whether to show the Sign in with Okta Verify button on the Sign-In Widget
Gets or Sets SigningAlgorithm
SignInPage
SignInPageAllOfWidgetCustomizations
Variant for the Okta sign-in page.
SignOnInlineHook
The request body required for a simulate policy operation
SimulatePolicyEvaluations
A list of evaluated but not matched policies and rules
A list of undefined but not matched policies and rules
The result of the policy evaluation
SimulateResultConditions
SimulateResultPoliciesItems
SimulateResultRules
The result of this entity evaluation
Determines if the app supports Single Logout (SLO)
Schema for the Slack app (key name: `slack`) To create a Slack app, use the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
SlackApplicationSettings
The entitlement management opt-in status for the app
Slack app instance properties
Determines if the app participates in Single Logout (SLO)
Request binding type
Attempts to activate an `sms` factor with the specified passcode
Verifies an OTP sent by an `sms` factor challenge.
SmsTemplate
Type of the Template
The social authentication token object provides the tokens and associated metadata provided by social providers
during social authentication.
SourceLinks
Edition of the Splunk Cloud instance
The session of the subject was revoked
The event subject
Supported SSO protocol configurations.
Defines the authenticators permitted for the initial authentication step of password recovery
Gets or Sets methods
<x-lifecycle class=\"oie\"></x-lifecycle> Describes the initial and secondary
authenticator requirements a user needs to reset their password
Determines which authentication requirements a user needs to perform self-service operations.
Defines the secondary authenticators needed for password reset if `required` is true.
Gets or Sets methods
StandardRole
StandardRoleAssignmentSchema
Specify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard
role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role
type:
Optional embedded resources for the role assignment
Targets configured for the role assignment
App targets
StreamConfiguration
The Subject Identifier format expected for any SET transmitted.
The audience used in the SET.
StreamConfigurationCreateRequest
The Subject Identifier format expected for any SET transmitted.
Contains information about the intended SET delivery method by the receiver
The delivery method that the transmitter uses for delivering a SET
Status corresponding to the `stream_id` of the SSF Stream
The status of the SSF Stream configuration
StreamVerificationRequest
STS connection to a service account
Type of connection authentication method
The authentication protocol type used for the connection
Create an STS connection for a service account
Type of connection authentication method
The authentication protocol type used for the connection
Reference to a service account in [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) format
STS connection to a vaulted secret
Type of connection authentication method
The authentication protocol type used for the connection
Create an STS connection for a vaulted secret
Type of connection authentication method
The authentication protocol type used for the connection
Reference to a vaulted secret in [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) format
Subject
The user identifier
Gets or Sets SubjectType
SubmissionAction
SubmissionActions
SubmissionCapabilities
SubmissionCapability
SubmissionRequest
SubmissionResponse
SubmissionResponseAppContactDetailsInner
Type of contact * `CUSTOMER_SUPPORT` - Public support contact details visible on your OIN catalog page
for end users needing assistance with your integration. * `ESCALATION_SUPPORT` - Private support
contact used by Okta to reach your organization during emergencies or escalations post-publication of the app
(not shared with customers).
Format of the contact value
SubmissionResponseConfigInner
SubmissionResponseGlobalTokenRevocation
Authentication method <br> **Note:** Currently, only the `SIGNED_JWT` method is supported.
The format of the subject
Subscription
Discoverable resources related to the subscription
The status of the subscription
The supported methods of an authenticator
The type of authenticator method
SupportedMethodsSettings
SwaApplicationSettings
The entitlement management opt-in status for the app
SwaApplicationSettingsApplication
TacAuthenticatorEnrollment
TelephonyRequest
TelephonyRequestData
Message profile specifies information about the telephony (sms/voice) message to be sent to the Okta user
User profile specifies information about the Okta user
Telephony inline hook request body
Telephony inline hook response
TelephonyResponseCommandsInner
TelephonyResponseCommandsInnerValueInner
Status of telephony callout
TempPassword
TenantSettings
Integration Testing Information
OIDC test details
SAML test details
SCIM test details
An account on a test instance of your app with admin privileges.
ThemeResponse
The third-party admin setting
ThreatInsightConfiguration
Specifies how Okta responds to authentication requests from suspicious IP addresses
Verifies an OTP for a `token` factor
TokenAuthorizationServerPolicyRuleAction
TokenAuthorizationServerPolicyRuleActionInlineHook
This implementation represents the api key that is used to authenticate a Tenant in Okta.
Gets or Sets TokenDeliveryMode
Verifies an OTP for a `token:hardware` factor
For the token inline hook, the `commands` and `error` objects that you can return in the JSON
payload of your response are defined in the following sections.
TokenHookResponseCommandsInner
TokenHookResponseCommandsInnerValueInner
Value to set the claim to.
When an error object is returned, it causes Okta to return an OAuth 2.0 error to the requester of the token.
Verifies an OTP for a `token:hotp` factor
TokenPayLoad
TokenPayLoadData
Provides information on the properties of the access token that Okta has generated, including the existing claims
that it contains
TokenPayLoadDataContext
The authorization server policy used to mint the token
The authorization server policy rule used to mint the token
Details of the authentication protocol
The client making the token request
The authorization server's issuer identifier
Information about the original token request used to get the refresh token being used, when in a refresh token
request
Details of the token request
The authorization response mode
The authorization response type
Token inline hook request
TokenResourcesHrefObject
TokenResponse
The token type in a `/token` response.
Attempts to activate a `token:software:totp` factor with the specified passcode
Verifies an OTP for a `token:software:totp` factor
The type of token for token exchange.
Schema for Trend Micro Apex One as a Service app (key name: `trendmicroapexoneservice`) To create a Trend
Micro Apex One as a Service app, use the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
TrendMicroApexOneServiceApplicationSettings
The entitlement management opt-in status for the app
Trend Micro Apex One as a Service app instance properties
TrustedOrigin
TrustedOriginScope
The scope type.
TrustedOriginWrite
Activates a `u2f` factor with the specified client and registration information from the U2F token
Verifies a `u2f` factor challenge by posting a signed assertion using the challenge `nonce`
Specifies the configuration of an input field on an enrollment form
UI Schema element options object
Specifies how the input appears
Properties of the UI schema
UISchemasResponseObject
UpdateAIAgentRequest
UpdateDefaultProvisioningConnectionForApplicationRequest
UpdateDomain
UpdateEmailDomain
UpdateFeatureForApplicationRequest
UpdateGroupPushMappingRequest
UpdateIamRoleRequest
UpdateRealmAssignmentRequest
UpdateRealmRequest
UpdateThemeRequest
The updated request body properties
UpdateUserRequest
The ID of the user type.
UploadYubikeyOtpTokenSeedRequest
User
The target status of an in-progress asynchronous status transition.
UserActivationToken
Describes how the account is blocked from access.
The devices that the block applies to
Type of access block
UserClassification
Specifies a set of users to be included or excluded
Specifies primary authentication and recovery credentials for a user.
Specifies primary authentication and recovery credentials for a user.
UserDevice
UserFactor
Activation requests have a short lifetime and expire if the activation isn't completed before the indicated
timestamp.
Result of a factor activation
UserFactorActivateRequest
UserFactorActivateResponse
Type of the factor
UserFactorActivateResponseLinks
UserFactorCall
UserFactorCallProfile
UserFactorEmail
UserFactorEmailProfile
UserFactorLinks
Gets or Sets UserFactorProvider
UserFactorPush
UserFactorPushProfile
UserFactorPushTransaction
Result of the verification transaction
UserFactorPushTransactionRejected
UserFactorPushTransactionRejectedAllOfLinks
UserFactorPushTransactionRejectedAllOfProfile
UserFactorPushTransactionTimeout
UserFactorPushTransactionTimeoutAllOfLinks
UserFactorPushTransactionWaitingNMC
UserFactorPushTransactionWaitingNMCAllOfLinks
UserFactorPushTransactionWaitingNoNMC
UserFactorPushTransactionWaitingNoNMCAllOfLinks
Result of a factor verification attempt
UserFactorSecurityQuestion
UserFactorSecurityQuestionProfile
Unique key for the question
UserFactorSMS
UserFactorSMSProfile
Status of the factor
UserFactorSupported
Indicates if the factor is required for the specified user
UserFactorToken
UserFactorTokenAllOfVerify
UserFactorTokenFactorVerificationObject
UserFactorTokenHardware
UserFactorTokenHardwareAllOfVerify
UserFactorTokenHOTP
UserFactorTokenHOTPProfile
UserFactorTokenProfile
UserFactorTokenSoftwareTOTP
UserFactorTokenVerifyRSA
UserFactorTokenVerifySymantec
Type of factor
UserFactorU2F
UserFactorU2FProfile
UserFactorVerifyRequest
UserFactorVerifyResponse
UserFactorVerifyResponseWaiting
UserFactorVerifyResponseWaitingEmbedded
Result of a factor verification
Result of a factor verification
UserFactorWeb
UserFactorWebAuthn
UserFactorWebAuthnProfile
UserFactorWebProfile
UserFactorYubikeyOtpToken
Token status
UserGetSingleton
The target status of an in-progress asynchronous status transition.
The embedded resources related to the object if the `expand` query parameter is specified
Specifies the details of the patterns to match against
The type of pattern.
Specifies a user identifier condition to match on
What to match against, either user ID or an attribute in the user's Okta profile.
UserIdentityProviderLinkRequest
UserImportRequest
UserImportRequestData
The object that specifies the default action Okta is set to take
The current default action that results when Okta imports a user.
The app user profile being imported
UserImportRequestDataContext
Details of the app from which the user is being imported
The status of the app
The details of the running import job
Provides information on the Okta user profile currently set to be used for the user who is being imported, based on
the matching rules and attribute mappings that were applied.
User import inline hook request
UserImportResponse
UserImportResponseCommandsInner
The command types supported for the import inline hook.
An object to return an error.
UserLifecycleAttributePolicyRuleCondition
UserLink
Specifies link relations (see [Web Linking](https://datatracker.ietf.org/doc/html/rfc8288) available for the current
status of a user.
UserLockoutSettings
Gets or Sets UserNextLogin
Specifies a set of Users to be included or excluded
Specifies the default and custom profile properties for a user.
UserProvisioningApplicationFeature
UserRequestSchema
UserResourceHrefObject
UserResponseSchema
UserRiskGetResponse
UserRiskGetResponseLinks
The risk level associated with the user
UserRiskLevelExists
UserRiskLevelNone
The risk level associated with the user
UserRiskPutResponse
UserRiskRequest
The risk level associated with the user
UserSchema
UserSchemaAttribute
UserSchemaAttributeEnum
Gets or Sets UserSchemaAttributeFormat
UserSchemaAttributeItems
UserSchemaAttributeMaster
UserSchemaAttributeMasterPriority
Gets or Sets UserSchemaAttributeMasterType
Gets or Sets UserSchemaAttributeMutabilityString
UserSchemaAttributePermission
Gets or Sets UserSchemaAttributeScope
Gets or Sets UserSchemaAttributeType
All Okta-defined profile properties are defined in a profile subschema with the resolution scope `#base`.
UserSchemaBaseProperties
UserSchemaDefinitions
UserSchemaProperties
UserSchemaPropertiesProfile
UserSchemaPropertiesProfileItem
All custom profile properties are defined in a profile subschema with the resolution scope `#custom`.
Link to the [Application
Users](/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers)
resource
The current status of the user.
UserStatusPolicyRuleCondition
UsersUpdateRequestSchema
The user type that determines the schema for the user's profile.
<x-lifecycle class=\"oie\"></x-lifecycle> Specifies which user types to include and/or
exclude
UserTypeLinks
UserTypePostRequest
UserTypePutRequest
User verification setting.
Validation detail
Action provider validation details
The method used to verify a user
Activates a `webauthn` factor with the specified attestation and registration information from the WebAuthn
authenticator
Verifies a `webauthn` factor challenge by posting a signed assertion using the challenge `nonce`
Method attachment
Credential request object for the initialized credential, along with the enrollment and key identifiers to associate
with the credential
Credential response object for enrolled credential details, along with enrollment and key identifiers to associate
the credential
User factor variant used for WebAuthn preregistration factors
The [RP ID](https://www.w3.org/TR/webauthn/#relying-party-identifier) object for WebAuthn configuration
The RP domain object for the WebAuthn configuration
Indicates the validation status of the domain
WellKnownAppAuthenticatorConfiguration
The type of authenticator
WellKnownAppAuthenticatorConfigurationSettings
WellKnownOrgMetadata
Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using
the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06)
specification
Metadata about Okta as a transmitter and relevant information for configuration.
A string that indicates the default behavior of newly created streams
WellKnownSSFMetadataSpecUrn
WellKnownURIArrayResponse
WellKnownURIArrayResponseLinks
WellKnownURIObjectResponse
WellKnownURIRequest
WellKnownURIsRoot
WellKnownURIsRootEmbedded
Contains the customized well-known URI content and links
Contains the customized well-known URI content and links
WellKnownURIsRootLinks
The generation of the Sign-in Widget
WorkflowActionProvider
WorkflowAvailableActionProvider
WorkflowsValidationDetailProvider
Validation error type
WsFederationApplication
`template_wsfed` is the key name for a WS-Federated app instance with a SAML 2.0 token
WsFederationApplicationSettings
The entitlement management opt-in status for the app
WsFederationApplicationSettingsApplication
Specifies the WS-Fed assertion attribute value for filtered groups.
Specifies additional username attribute statements to include in the WS-Fed assertion
Schema for the Zoom app (key name: `zoomus`) To create a Zoom app, use the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
ZoomUsApplicationSettings
The entitlement management opt-in status for the app
Zoom app instance properties
Schema for the Zscaler 2.0 app (key name: `zscalerbyz`) To create a Zscaler 2.0 app, use the [Create an
Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication)
request with the following parameters in the request body.
Gets or Sets name
Gets or Sets signOnMode
ZscalerbyzApplicationSettings
The entitlement management opt-in status for the app
Zscaler app instance properties