Package com.okta.sdk.resource.api

Class UserFactorApi

java.lang.Object
com.okta.sdk.resource.api.UserFactorApi
@Generated(value="org.openapitools.codegen.languages.JavaClientCodegen", date="2026-03-13T17:36:05.533634+05:30[Asia/Kolkata]", comments="Generator version: 7.15.0") public class UserFactorApi extends Object

  • Constructor Details

    • UserFactorApi

      public UserFactorApi()

    • UserFactorApi

      public UserFactorApi(ApiClient apiClient)

  • Method Details

    • getApiClient

      public ApiClient getApiClient()

    • setApiClient

      public void setApiClient(ApiClient apiClient)

    • activateFactor

      public UserFactorActivateResponse activateFactor(String userId, String factorId, UserFactorActivateRequest body) throws ApiException
      Activate a factor Activates a factor. Some factors (`call`, `email`, `push`, `sms`, `token:software:totp`, `u2f`, and `webauthn`) require activation to complete the enrollment process. Okta enforces a rate limit of five activation attempts within five minutes. After a user exceeds the rate limit, Okta returns an error message. > **Notes:** > * If the user exceeds their SMS, call, or email factor activation rate limit, then an [OTP resend request](./#tag/UserFactor/operation/resendEnrollFactor) isn't allowed for the same factor. > * You can't use the Factors API to activate Okta Fastpass (`signed_nonce`) for a user. See [Configure Okta Fastpass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure).
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      body - (optional)
      Returns:
      UserFactorActivateResponse
      Throws:
      ApiException - if fails to make API call

    • activateFactor

      public UserFactorActivateResponse activateFactor(String userId, String factorId, UserFactorActivateRequest body, Map<String,String> additionalHeaders) throws ApiException
      Activate a factor Activates a factor. Some factors (`call`, `email`, `push`, `sms`, `token:software:totp`, `u2f`, and `webauthn`) require activation to complete the enrollment process. Okta enforces a rate limit of five activation attempts within five minutes. After a user exceeds the rate limit, Okta returns an error message. > **Notes:** > * If the user exceeds their SMS, call, or email factor activation rate limit, then an [OTP resend request](./#tag/UserFactor/operation/resendEnrollFactor) isn't allowed for the same factor. > * You can't use the Factors API to activate Okta Fastpass (`signed_nonce`) for a user. See [Configure Okta Fastpass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure).
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      body - (optional)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactorActivateResponse
      Throws:
      ApiException - if fails to make API call

    • enrollFactor

      public UserFactor enrollFactor(String userId, UserFactor body, Boolean updatePhone, String templateId, Integer tokenLifetimeSeconds, Boolean activate, String acceptLanguage) throws ApiException
      Enroll a factor Enrolls a supported factor for the specified user > **Notes:** > * All responses return the enrolled factor with a status of either `PENDING_ACTIVATION` or `ACTIVE`. > * You can't use the Factors API to enroll Okta Fastpass (`signed_nonce`) for a user. See [Configure Okta Fastpass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). #### Additional SMS/Call factor information * **Rate limits**: Okta may return a `429 Too Many Requests` status code if you attempt to resend an SMS or a voice call challenge (OTP) within the same time window. The current [rate limit](https://developer.okta.com/docs/reference/rate-limits/) is one SMS/CALL challenge per phone number every 30 seconds. * **Existing phone numbers**: Okta may return a `400 Bad Request` status code if a user attempts to enroll with a different phone number when the user has an existing mobile phone or has an existing phone with voice call capability. A user can enroll only one mobile phone for `sms` and enroll only one voice call capable phone for `call` factor. #### Additional WebAuthn factor information * For detailed information on the WebAuthn standard, including an up-to-date list of supported browsers, see [webauthn.me](https://a0.to/webauthnme-okta-docs). * When you enroll a WebAuthn factor, the `activation` object in `_embedded` contains properties used to help the client to create a new WebAuthn credential for use with Okta. See the [WebAuthn spec for PublicKeyCredentialCreationOptions](https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions). #### Additional Custom TOTP factor information * The enrollment process involves passing both the `factorProfileId` and `sharedSecret` properties for a token. * A factor profile represents a particular configuration of the Custom TOTP factor. It includes certain properties that match the hardware token that end users possess, such as the HMAC algorithm, passcode length, and time interval. There can be multiple Custom TOTP factor profiles per org, but users can only enroll in one Custom TOTP factor. Admins can [create Custom TOTP factor profiles](https://help.okta.com/okta_help.htm?id=ext-mfa-totp) in the Admin Console. Then, copy the `factorProfileId` from the Admin Console into the API request. * <x-lifecycle class=\"oie\"></x-lifecycle> For Custom TOTP enrollment, Okta automaticaly enrolls a user with a `token:software:totp` factor and the `push` factor if the user isn't currently enrolled with these factors.
      Parameters:
      userId - ID of an existing Okta user (required)
      body - Factor (required)
      updatePhone - If `true`, indicates that you are replacing the currently registered phone number for the specified user. This parameter is ignored if the existing phone number is used by an activated factor. (optional, default to false)
      templateId - ID of an existing custom SMS template. See the [SMS Templates API](../Template). This parameter is only used by `sms` factors. If the provided ID doesn't exist, the default template is used instead. (optional)
      tokenLifetimeSeconds - Defines how long the token remains valid (optional, default to 300)
      activate - If `true`, the factor is immediately activated as part of the enrollment. An activation process isn't required. Currently auto-activation is supported by `sms`, `call`, `email` and `token:hotp` (Custom TOTP) factors. (optional, default to false)
      acceptLanguage - An ISO 639-1 two-letter language code that defines a localized message to send. This parameter is only used by `sms` factors. If a localized message doesn't exist or the `templateId` is incorrect, the default template is used instead. (optional)
      Returns:
      UserFactor
      Throws:
      ApiException - if fails to make API call

    • enrollFactor

      public UserFactor enrollFactor(String userId, UserFactor body, Boolean updatePhone, String templateId, Integer tokenLifetimeSeconds, Boolean activate, String acceptLanguage, Map<String,String> additionalHeaders) throws ApiException
      Enroll a factor Enrolls a supported factor for the specified user > **Notes:** > * All responses return the enrolled factor with a status of either `PENDING_ACTIVATION` or `ACTIVE`. > * You can't use the Factors API to enroll Okta Fastpass (`signed_nonce`) for a user. See [Configure Okta Fastpass](https://help.okta.com/okta_help.htm?type=oie&id=ext-fp-configure). #### Additional SMS/Call factor information * **Rate limits**: Okta may return a `429 Too Many Requests` status code if you attempt to resend an SMS or a voice call challenge (OTP) within the same time window. The current [rate limit](https://developer.okta.com/docs/reference/rate-limits/) is one SMS/CALL challenge per phone number every 30 seconds. * **Existing phone numbers**: Okta may return a `400 Bad Request` status code if a user attempts to enroll with a different phone number when the user has an existing mobile phone or has an existing phone with voice call capability. A user can enroll only one mobile phone for `sms` and enroll only one voice call capable phone for `call` factor. #### Additional WebAuthn factor information * For detailed information on the WebAuthn standard, including an up-to-date list of supported browsers, see [webauthn.me](https://a0.to/webauthnme-okta-docs). * When you enroll a WebAuthn factor, the `activation` object in `_embedded` contains properties used to help the client to create a new WebAuthn credential for use with Okta. See the [WebAuthn spec for PublicKeyCredentialCreationOptions](https://www.w3.org/TR/webauthn/#dictionary-makecredentialoptions). #### Additional Custom TOTP factor information * The enrollment process involves passing both the `factorProfileId` and `sharedSecret` properties for a token. * A factor profile represents a particular configuration of the Custom TOTP factor. It includes certain properties that match the hardware token that end users possess, such as the HMAC algorithm, passcode length, and time interval. There can be multiple Custom TOTP factor profiles per org, but users can only enroll in one Custom TOTP factor. Admins can [create Custom TOTP factor profiles](https://help.okta.com/okta_help.htm?id=ext-mfa-totp) in the Admin Console. Then, copy the `factorProfileId` from the Admin Console into the API request. * <x-lifecycle class=\"oie\"></x-lifecycle> For Custom TOTP enrollment, Okta automaticaly enrolls a user with a `token:software:totp` factor and the `push` factor if the user isn't currently enrolled with these factors.
      Parameters:
      userId - ID of an existing Okta user (required)
      body - Factor (required)
      updatePhone - If `true`, indicates that you are replacing the currently registered phone number for the specified user. This parameter is ignored if the existing phone number is used by an activated factor. (optional, default to false)
      templateId - ID of an existing custom SMS template. See the [SMS Templates API](../Template). This parameter is only used by `sms` factors. If the provided ID doesn't exist, the default template is used instead. (optional)
      tokenLifetimeSeconds - Defines how long the token remains valid (optional, default to 300)
      activate - If `true`, the factor is immediately activated as part of the enrollment. An activation process isn't required. Currently auto-activation is supported by `sms`, `call`, `email` and `token:hotp` (Custom TOTP) factors. (optional, default to false)
      acceptLanguage - An ISO 639-1 two-letter language code that defines a localized message to send. This parameter is only used by `sms` factors. If a localized message doesn't exist or the `templateId` is incorrect, the default template is used instead. (optional)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactor
      Throws:
      ApiException - if fails to make API call

    • getFactor

      public UserFactor getFactor(String userId, String factorId) throws ApiException
      Retrieve a factor Retrieves an existing factor for the specified user
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      Returns:
      UserFactor
      Throws:
      ApiException - if fails to make API call

    • getFactor

      public UserFactor getFactor(String userId, String factorId, Map<String,String> additionalHeaders) throws ApiException
      Retrieve a factor Retrieves an existing factor for the specified user
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactor
      Throws:
      ApiException - if fails to make API call

    • getFactorTransactionStatus

      public UserFactorPushTransaction getFactorTransactionStatus(String userId, String factorId, String transactionId) throws ApiException
      Retrieve a factor transaction status Retrieves the status of a `push` factor verification transaction > **Note:** > The response body for a number matching push challenge to an Okta Verify `push` factor enrollment is different from the response body of a standard push challenge. > The number matching push challenge [response body](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/getFactorTransactionStatus!c=200&path=1/_embedded&t=response) contains the correct answer for the challenge. > Use [Verify a factor](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor) to configure which challenge is sent.
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      transactionId - ID of an existing factor verification transaction (required)
      Returns:
      UserFactorPushTransaction
      Throws:
      ApiException - if fails to make API call

    • getFactorTransactionStatus

      public UserFactorPushTransaction getFactorTransactionStatus(String userId, String factorId, String transactionId, Map<String,String> additionalHeaders) throws ApiException
      Retrieve a factor transaction status Retrieves the status of a `push` factor verification transaction > **Note:** > The response body for a number matching push challenge to an Okta Verify `push` factor enrollment is different from the response body of a standard push challenge. > The number matching push challenge [response body](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/getFactorTransactionStatus!c=200&path=1/_embedded&t=response) contains the correct answer for the challenge. > Use [Verify a factor](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor) to configure which challenge is sent.
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      transactionId - ID of an existing factor verification transaction (required)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactorPushTransaction
      Throws:
      ApiException - if fails to make API call

    • getYubikeyOtpTokenById

      public UserFactorYubikeyOtpToken getYubikeyOtpTokenById(String tokenId) throws ApiException
      Retrieve a YubiKey OTP token Retrieves the specified YubiKey OTP token by `id`
      Parameters:
      tokenId - ID of a YubiKey token (required)
      Returns:
      UserFactorYubikeyOtpToken
      Throws:
      ApiException - if fails to make API call

    • getYubikeyOtpTokenById

      public UserFactorYubikeyOtpToken getYubikeyOtpTokenById(String tokenId, Map<String,String> additionalHeaders) throws ApiException
      Retrieve a YubiKey OTP token Retrieves the specified YubiKey OTP token by `id`
      Parameters:
      tokenId - ID of a YubiKey token (required)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactorYubikeyOtpToken
      Throws:
      ApiException - if fails to make API call

    • listFactors

      public List<UserFactor> listFactors(String userId) throws ApiException
      List all enrolled factors Lists all enrolled factors for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all enrolled factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America).
      Parameters:
      userId - ID of an existing Okta user (required)
      Returns:
      List<UserFactor>
      Throws:
      ApiException - if fails to make API call

    • listFactors

      public List<UserFactor> listFactors(String userId, Map<String,String> additionalHeaders) throws ApiException
      List all enrolled factors Lists all enrolled factors for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all enrolled factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America).
      Parameters:
      userId - ID of an existing Okta user (required)
      additionalHeaders - additionalHeaders for this call
      Returns:
      List<UserFactor>
      Throws:
      ApiException - if fails to make API call

    • listFactorsPaged

      public Iterable<UserFactor> listFactorsPaged(String userId)
      List all enrolled factors (Paginated) Lists all enrolled factors for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all enrolled factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America). This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks. Use this method in a for-each loop to automatically fetch all pages without manual cursor management.
      Parameters:
      userId - ID of an existing Okta user (required)
      Returns:
      Iterable<UserFactor> lazy iterable over all pages

    • listFactorsPaged

      public Iterable<UserFactor> listFactorsPaged(String userId, Map<String,String> additionalHeaders)
      List all enrolled factors (Paginated with additional headers) Lists all enrolled factors for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only enrolled factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all enrolled factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America). This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks.
      Parameters:
      userId - ID of an existing Okta user (required)
      additionalHeaders - additional headers for this call
      Returns:
      Iterable<UserFactor> lazy iterable over all pages

    • listSupportedFactors

      public List<UserFactorSupported> listSupportedFactors(String userId) throws ApiException
      List all supported factors Lists all the supported factors that can be enrolled for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all supported factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America).
      Parameters:
      userId - ID of an existing Okta user (required)
      Returns:
      List<UserFactorSupported>
      Throws:
      ApiException - if fails to make API call

    • listSupportedFactors

      public List<UserFactorSupported> listSupportedFactors(String userId, Map<String,String> additionalHeaders) throws ApiException
      List all supported factors Lists all the supported factors that can be enrolled for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all supported factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America).
      Parameters:
      userId - ID of an existing Okta user (required)
      additionalHeaders - additionalHeaders for this call
      Returns:
      List<UserFactorSupported>
      Throws:
      ApiException - if fails to make API call

    • listSupportedFactorsPaged

      public Iterable<UserFactorSupported> listSupportedFactorsPaged(String userId)
      List all supported factors (Paginated) Lists all the supported factors that can be enrolled for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all supported factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America). This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks. Use this method in a for-each loop to automatically fetch all pages without manual cursor management.
      Parameters:
      userId - ID of an existing Okta user (required)
      Returns:
      Iterable<UserFactorSupported> lazy iterable over all pages

    • listSupportedFactorsPaged

      public Iterable<UserFactorSupported> listSupportedFactorsPaged(String userId, Map<String,String> additionalHeaders)
      List all supported factors (Paginated with additional headers) Lists all the supported factors that can be enrolled for the specified user that are included in the highest priority [authenticator enrollment policy](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Policy/) that applies to the user. Only factors that are `REQUIRED` or `OPTIONAL` in the highest priority authenticator enrollment policy can be returned. > **Note:** When admins use this endpoint for other users, the authenticator enrollment policy that's evaluated can vary depending on how client-specific conditions are configured in the rules of an authenticator enrollment policy. The client-specific conditions of the admin's client are used during policy evaluation instead of the client-specific conditions of the user. This can affect which authenticator enrollment policy is evaluated and which factors are returned. > > For example, an admin in Europe lists all supported factors for a user in North America. The network zone of the admin's client (in Europe) is used during policy evaluation instead of the network zone of the user (in North America). This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks.
      Parameters:
      userId - ID of an existing Okta user (required)
      additionalHeaders - additional headers for this call
      Returns:
      Iterable<UserFactorSupported> lazy iterable over all pages

    • listSupportedSecurityQuestions

      public List<UserFactorSecurityQuestionProfile> listSupportedSecurityQuestions(String userId) throws ApiException
      List all supported security questions Lists all available security questions for the specified user
      Parameters:
      userId - ID of an existing Okta user (required)
      Returns:
      List<UserFactorSecurityQuestionProfile>
      Throws:
      ApiException - if fails to make API call

    • listSupportedSecurityQuestions

      public List<UserFactorSecurityQuestionProfile> listSupportedSecurityQuestions(String userId, Map<String,String> additionalHeaders) throws ApiException
      List all supported security questions Lists all available security questions for the specified user
      Parameters:
      userId - ID of an existing Okta user (required)
      additionalHeaders - additionalHeaders for this call
      Returns:
      List<UserFactorSecurityQuestionProfile>
      Throws:
      ApiException - if fails to make API call

    • listSupportedSecurityQuestionsPaged

      public Iterable<UserFactorSecurityQuestionProfile> listSupportedSecurityQuestionsPaged(String userId)
      List all supported security questions (Paginated) Lists all available security questions for the specified user This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks. Use this method in a for-each loop to automatically fetch all pages without manual cursor management.
      Parameters:
      userId - ID of an existing Okta user (required)
      Returns:
      Iterable<UserFactorSecurityQuestionProfile> lazy iterable over all pages

    • listSupportedSecurityQuestionsPaged

      public Iterable<UserFactorSecurityQuestionProfile> listSupportedSecurityQuestionsPaged(String userId, Map<String,String> additionalHeaders)
      List all supported security questions (Paginated with additional headers) Lists all available security questions for the specified user This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks.
      Parameters:
      userId - ID of an existing Okta user (required)
      additionalHeaders - additional headers for this call
      Returns:
      Iterable<UserFactorSecurityQuestionProfile> lazy iterable over all pages

    • listYubikeyOtpTokens

      public List<UserFactorYubikeyOtpToken> listYubikeyOtpTokens(String after, String expand, String filter, Boolean forDownload, Integer limit, String sortBy, String sortOrder) throws ApiException
      List all YubiKey OTP tokens Lists all YubiKey OTP tokens
      Parameters:
      after - Specifies the pagination cursor for the next page of tokens (optional)
      expand - Embeds the [user](/openapi/okta-management/management/tag/User/) resource if the YubiKey token is assigned to a user and `expand` is set to `user` (optional)
      filter - The expression used to filter tokens (optional)
      forDownload - Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. (optional, default to false)
      limit - Specifies the number of results per page (optional, default to 20)
      sortBy - The value of how the tokens are sorted (optional)
      sortOrder - Specifies the sort order, either `ASC` or `DESC` (optional)
      Returns:
      List<UserFactorYubikeyOtpToken>
      Throws:
      ApiException - if fails to make API call

    • listYubikeyOtpTokens

      public List<UserFactorYubikeyOtpToken> listYubikeyOtpTokens(String after, String expand, String filter, Boolean forDownload, Integer limit, String sortBy, String sortOrder, Map<String,String> additionalHeaders) throws ApiException
      List all YubiKey OTP tokens Lists all YubiKey OTP tokens
      Parameters:
      after - Specifies the pagination cursor for the next page of tokens (optional)
      expand - Embeds the [user](/openapi/okta-management/management/tag/User/) resource if the YubiKey token is assigned to a user and `expand` is set to `user` (optional)
      filter - The expression used to filter tokens (optional)
      forDownload - Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. (optional, default to false)
      limit - Specifies the number of results per page (optional, default to 20)
      sortBy - The value of how the tokens are sorted (optional)
      sortOrder - Specifies the sort order, either `ASC` or `DESC` (optional)
      additionalHeaders - additionalHeaders for this call
      Returns:
      List<UserFactorYubikeyOtpToken>
      Throws:
      ApiException - if fails to make API call

    • listYubikeyOtpTokensPaged

      public Iterable<UserFactorYubikeyOtpToken> listYubikeyOtpTokensPaged(String after, String expand, String filter, Boolean forDownload, Integer limit, String sortBy, String sortOrder)
      List all YubiKey OTP tokens (Paginated) Lists all YubiKey OTP tokens This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks. Use this method in a for-each loop to automatically fetch all pages without manual cursor management.
      Parameters:
      after - Specifies the pagination cursor for the next page of tokens (optional)
      expand - Embeds the [user](/openapi/okta-management/management/tag/User/) resource if the YubiKey token is assigned to a user and `expand` is set to `user` (optional)
      filter - The expression used to filter tokens (optional)
      forDownload - Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. (optional, default to false)
      limit - Specifies the number of results per page (optional, default to 20)
      sortBy - The value of how the tokens are sorted (optional)
      sortOrder - Specifies the sort order, either `ASC` or `DESC` (optional)
      Returns:
      Iterable<UserFactorYubikeyOtpToken> lazy iterable over all pages

    • listYubikeyOtpTokensPaged

      public Iterable<UserFactorYubikeyOtpToken> listYubikeyOtpTokensPaged(String after, String expand, String filter, Boolean forDownload, Integer limit, String sortBy, String sortOrder, Map<String,String> additionalHeaders)
      List all YubiKey OTP tokens (Paginated with additional headers) Lists all YubiKey OTP tokens This method returns a lazy, paginated iterable that automatically handles pagination. It is thread-safe and does not cause memory leaks.
      Parameters:
      after - Specifies the pagination cursor for the next page of tokens (optional)
      expand - Embeds the [user](/openapi/okta-management/management/tag/User/) resource if the YubiKey token is assigned to a user and `expand` is set to `user` (optional)
      filter - The expression used to filter tokens (optional)
      forDownload - Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. (optional, default to false)
      limit - Specifies the number of results per page (optional, default to 20)
      sortBy - The value of how the tokens are sorted (optional)
      sortOrder - Specifies the sort order, either `ASC` or `DESC` (optional)
      additionalHeaders - additional headers for this call
      Returns:
      Iterable<UserFactorYubikeyOtpToken> lazy iterable over all pages

    • resendEnrollFactor

      public ResendUserFactor resendEnrollFactor(String userId, String factorId, ResendUserFactor resendUserFactor, String templateId) throws ApiException
      Resend a factor enrollment Resends an `sms`, `call`, or `email` factor challenge as part of an enrollment flow. For `call` and `sms` factors, Okta enforces a rate limit of one OTP challenge per device every 30 seconds. You can configure your `sms` and `call` factors to use a third-party telephony provider. See the [Telephony inline hook reference](https://developer.okta.com/docs/reference/telephony-hook/). Okta alternates between SMS providers with every resend request to ensure delivery of SMS and Call OTPs across different carriers. > **Note:** Resend operations aren't allowed after a factor exceeds the activation rate limit. See [Activate a factor](./#tag/UserFactor/operation/activateFactor).
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      resendUserFactor - (required)
      templateId - ID of an existing custom SMS template. See the [SMS Templates API](../Template). This parameter is only used by `sms` factors. (optional)
      Returns:
      ResendUserFactor
      Throws:
      ApiException - if fails to make API call

    • resendEnrollFactor

      public ResendUserFactor resendEnrollFactor(String userId, String factorId, ResendUserFactor resendUserFactor, String templateId, Map<String,String> additionalHeaders) throws ApiException
      Resend a factor enrollment Resends an `sms`, `call`, or `email` factor challenge as part of an enrollment flow. For `call` and `sms` factors, Okta enforces a rate limit of one OTP challenge per device every 30 seconds. You can configure your `sms` and `call` factors to use a third-party telephony provider. See the [Telephony inline hook reference](https://developer.okta.com/docs/reference/telephony-hook/). Okta alternates between SMS providers with every resend request to ensure delivery of SMS and Call OTPs across different carriers. > **Note:** Resend operations aren't allowed after a factor exceeds the activation rate limit. See [Activate a factor](./#tag/UserFactor/operation/activateFactor).
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      resendUserFactor - (required)
      templateId - ID of an existing custom SMS template. See the [SMS Templates API](../Template). This parameter is only used by `sms` factors. (optional)
      additionalHeaders - additionalHeaders for this call
      Returns:
      ResendUserFactor
      Throws:
      ApiException - if fails to make API call

    • unenrollFactor

      public void unenrollFactor(String userId, String factorId, Boolean removeRecoveryEnrollment) throws ApiException
      Unenroll a factor Unenrolls an existing factor for the specified user. You can't unenroll a factor from a deactivated user. Unenrolling a factor allows the user to enroll a new factor. > **Note:** If you unenroll the `push` or the `signed_nonce` factors, Okta also unenrolls any other `totp`, `signed_nonce`, or Okta Verify `push` factors associated with the user.
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      removeRecoveryEnrollment - If `true`, removes the phone number as both a recovery method and a factor. This parameter is only used for the `sms` and `call` factors. (optional, default to false)
      Throws:
      ApiException - if fails to make API call

    • unenrollFactor

      public void unenrollFactor(String userId, String factorId, Boolean removeRecoveryEnrollment, Map<String,String> additionalHeaders) throws ApiException
      Unenroll a factor Unenrolls an existing factor for the specified user. You can't unenroll a factor from a deactivated user. Unenrolling a factor allows the user to enroll a new factor. > **Note:** If you unenroll the `push` or the `signed_nonce` factors, Okta also unenrolls any other `totp`, `signed_nonce`, or Okta Verify `push` factors associated with the user.
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      removeRecoveryEnrollment - If `true`, removes the phone number as both a recovery method and a factor. This parameter is only used for the `sms` and `call` factors. (optional, default to false)
      additionalHeaders - additionalHeaders for this call
      Throws:
      ApiException - if fails to make API call

    • uploadYubikeyOtpTokenSeed

      public UserFactorYubikeyOtpToken uploadYubikeyOtpTokenSeed(UploadYubikeyOtpTokenSeedRequest uploadYubikeyOtpTokenSeedRequest, String after, String expand, String filter, Boolean forDownload, Integer limit, String sortBy, String sortOrder) throws ApiException
      Upload a YubiKey OTP seed Uploads a seed for a user to enroll a YubiKey OTP
      Parameters:
      uploadYubikeyOtpTokenSeedRequest - (required)
      after - Specifies the pagination cursor for the next page of tokens (optional)
      expand - Embeds the [user](/openapi/okta-management/management/tag/User/) resource if the YubiKey token is assigned to a user and `expand` is set to `user` (optional)
      filter - The expression used to filter tokens (optional)
      forDownload - Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. (optional, default to false)
      limit - Specifies the number of results per page (optional, default to 20)
      sortBy - The value of how the tokens are sorted (optional)
      sortOrder - Specifies the sort order, either `ASC` or `DESC` (optional)
      Returns:
      UserFactorYubikeyOtpToken
      Throws:
      ApiException - if fails to make API call

    • uploadYubikeyOtpTokenSeed

      public UserFactorYubikeyOtpToken uploadYubikeyOtpTokenSeed(UploadYubikeyOtpTokenSeedRequest uploadYubikeyOtpTokenSeedRequest, String after, String expand, String filter, Boolean forDownload, Integer limit, String sortBy, String sortOrder, Map<String,String> additionalHeaders) throws ApiException
      Upload a YubiKey OTP seed Uploads a seed for a user to enroll a YubiKey OTP
      Parameters:
      uploadYubikeyOtpTokenSeedRequest - (required)
      after - Specifies the pagination cursor for the next page of tokens (optional)
      expand - Embeds the [user](/openapi/okta-management/management/tag/User/) resource if the YubiKey token is assigned to a user and `expand` is set to `user` (optional)
      filter - The expression used to filter tokens (optional)
      forDownload - Returns tokens in a CSV to download instead of in the response. When you use this query parameter, the `limit` default changes to 1000. (optional, default to false)
      limit - Specifies the number of results per page (optional, default to 20)
      sortBy - The value of how the tokens are sorted (optional)
      sortOrder - Specifies the sort order, either `ASC` or `DESC` (optional)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactorYubikeyOtpToken
      Throws:
      ApiException - if fails to make API call

    • verifyFactor

      public UserFactorVerifyResponse verifyFactor(String userId, String factorId, String templateId, Integer tokenLifetimeSeconds, String xForwardedFor, String userAgent, String acceptLanguage, UserFactorVerifyRequest body) throws ApiException
      Verify a factor Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Notes:** > - You can send standard push challenges or number matching push challenges to Okta Verify `push` factor enrollments. Use a [request body](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!path=2/useNumberMatchingChallenge&t=request) for number matching push challenges. > - To verify a `push` factor, use the **poll** link returned when you issue the challenge. See [Retrieve a factor transaction status](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/getFactorTransactionStatus).
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      templateId - ID of an existing custom SMS template. See the [SMS Templates API](../Template). This parameter is only used by `sms` factors. (optional)
      tokenLifetimeSeconds - Defines how long the token remains valid (optional, default to 300)
      xForwardedFor - Public IP address for the user agent (optional)
      userAgent - Type of user agent detected when the request is made. Required to verify `push` factors. (optional)
      acceptLanguage - An ISO 639-1 two-letter language code that defines a localized message to send. This parameter is only used by `sms` factors. If a localized message doesn't exist or the `templateId` is incorrect, the default template is used instead. (optional)
      body - Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Note:** > Unlike standard push challenges that don't require a request body, a number matching [`push`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!path=2/useNumberMatchingChallenge&t=request) challenge requires a request body. `useNumberMatchingChallenge` must be set to `true`. > When a number matching challenge is issued for an Okta Verify `push` factor enrollment, a `correctAnswer` challenge object is returned in the [`_embedded`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!c=200&path=_embedded&t=response) object. (optional)
      Returns:
      UserFactorVerifyResponse
      Throws:
      ApiException - if fails to make API call

    • verifyFactor

      public UserFactorVerifyResponse verifyFactor(String userId, String factorId, String templateId, Integer tokenLifetimeSeconds, String xForwardedFor, String userAgent, String acceptLanguage, UserFactorVerifyRequest body, Map<String,String> additionalHeaders) throws ApiException
      Verify a factor Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Notes:** > - You can send standard push challenges or number matching push challenges to Okta Verify `push` factor enrollments. Use a [request body](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!path=2/useNumberMatchingChallenge&t=request) for number matching push challenges. > - To verify a `push` factor, use the **poll** link returned when you issue the challenge. See [Retrieve a factor transaction status](/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/getFactorTransactionStatus).
      Parameters:
      userId - ID of an existing Okta user (required)
      factorId - ID of an existing user factor (required)
      templateId - ID of an existing custom SMS template. See the [SMS Templates API](../Template). This parameter is only used by `sms` factors. (optional)
      tokenLifetimeSeconds - Defines how long the token remains valid (optional, default to 300)
      xForwardedFor - Public IP address for the user agent (optional)
      userAgent - Type of user agent detected when the request is made. Required to verify `push` factors. (optional)
      acceptLanguage - An ISO 639-1 two-letter language code that defines a localized message to send. This parameter is only used by `sms` factors. If a localized message doesn't exist or the `templateId` is incorrect, the default template is used instead. (optional)
      body - Verifies an OTP for a factor. Some factors (`call`, `email`, `push`, `sms`, `u2f`, and `webauthn`) must first issue a challenge before you can verify the factor. Do this by making a request without a body. After a challenge is issued, make another request to verify the factor. > **Note:** > Unlike standard push challenges that don't require a request body, a number matching [`push`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!path=2/useNumberMatchingChallenge&t=request) challenge requires a request body. `useNumberMatchingChallenge` must be set to `true`. > When a number matching challenge is issued for an Okta Verify `push` factor enrollment, a `correctAnswer` challenge object is returned in the [`_embedded`](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/UserFactor/#tag/UserFactor/operation/verifyFactor!c=200&path=_embedded&t=response) object. (optional)
      additionalHeaders - additionalHeaders for this call
      Returns:
      UserFactorVerifyResponse
      Throws:
      ApiException - if fails to make API call

    • getObjectMapper

      protected static com.fasterxml.jackson.databind.ObjectMapper getObjectMapper()