Package com.okta.sdk.resource.model
package com.okta.sdk.resource.model
-
ClassDescriptionContains additional properties about custom AAGUID.AAGUIDGroupObjectAccessPolicyConsists of a `POSSESSION` constraint, a `KNOWLEDGE` constraint, or both.Gets or Sets methodsGets or Sets typesSpecifies constraints for the authenticator.Link to the app access policy resourceAccessPolicyRuleAccessPolicyRuleActionsSpecifies the results when a user attempts to sign inGets or Sets AccessPolicyRuleApplicationSignOnAccessAccessPolicyRuleConditionsSpecifies [Okta Expression Language](https://developer.okta.com/docs/reference/okta-expression-language-in-identity-engine/) expressions<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>The algorithm for encrypting access tokens issued by this authorization server.An array of ACS endpoints.ActionProviderType of action providerGets or Sets ActionProviderTypeAction to apply to a userThe scope of the group in Active DirectoryThe type of the group in Active DirectoryAddGroupRequestAddJwkRequestCryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web KeySettings specific to the Okta Admin ConsoleAgent detailsDetails about the Active Directory group membership updateAgentJsonSigningKeyCommonAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.AgentJsonSigningKeyRequestThe cryptographic curve that's used for the key pairCryptographic algorithm family for the certificate's key pairStatus of the AI agent JSON Web KeyAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.AgentJsonSigningKeyResponseThe cryptographic curve that's used for the key pairCryptographic algorithm family for the certificate's key pairStatus of the AI agent JSON Web KeyAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.An EC signing keyThe cryptographic curve that's used for the key pairCryptographic algorithm family for the certificate's key pairStatus of the AI agent JSON Web KeyAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.An EC signing keyThe cryptographic curve that's used for the key pairCryptographic algorithm family for the certificate's key pairStatus of the AI agent JSON Web KeyAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.AgentJsonWebKeyRequestBaseStatus of the AI agent JSON Web KeyAgentJsonWebKeyResponseBaseAn RSA signing keyCryptographic algorithm family for the certificate's key pairStatus of the AI agent JSON Web KeyAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.An RSA signing keyCryptographic algorithm family for the certificate's key pairStatus of the AI agent JSON Web KeyAcceptable use of the JSON Web Key You can only use signing keys for AI agents, so the value of `use` is always `sig`.An agent pool is a collection of agents that serve a common purpose.Various information about agent auto-update configurationSetting for auto-updateSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an AI agent using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Agent types that are being monitoredStatus for one agent regarding the status to auto-update that agentOverall state for the auto-update job from the admin perspectiveAIAgentWhen an AI agent is created, it's in the STAGED status.AIAgentOperationListResponseAIAgentOperationListResponseLinksAIAgentOperationResponseThe status of the AI agent operationThe AI agent operation typeAI agent profileThe AI agent resource associated with the operation.The allowed types of uses for the authenticatorAndroid Device Trust integration providerAPIServiceIntegrationInstanceAPIServiceIntegrationInstanceSecretStatus of the API Service Integration instance SecretSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.An API token for an Okta User.The Network Condition of the API TokenAn API Token Update Object for an Okta user.APNSConfigurationAPNSPushProviderContainer details for resource type APP_ACCOUNTAppAccountContainerLinkAppAndInstanceConditionEvaluatorAppOrInstanceSpecifies apps to include or exclude.Type of appAdditional app configuration for group push mappings.AppConfigActiveDirectoryThe type of the app configurationAppConnectionUserProvisionJWKListAppConnectionUserProvisionJWKResponseAppCustomHrefObjectDescribes allowed HTTP verbs for the `href`AppGroupAuthorization server for app instance connectionsCurrent status of the application instanceAppInstancePolicyRuleConditionAppInstancePropertyInformation used to generate the secret JSON Web Token for the token requests to Apple IdP > **Note:** The `privateKey` property is required for a CREATE request.ApplicationGets or Sets featuresSpecifies access settings for the appCapabilities supported by the appCredentials for the specified `signOnMode`ApplicationCredentialsOAuthClientApps with `BASIC_AUTH`, `BROWSER_PLUGIN`, or `SECURE_PASSWORD_STORE` sign-on modes have credentials vaulted by Okta and can be configured with the following schemes.App signing key properties > **Note:** Only apps with SAML_2_0, SAML_1_1, WS_FEDERATION, or OPENID_CONNECT `signOnMode` support the key rotation feature.Specifies the intended use of the keyThe template used to generate the username when the app is assigned through a group or directly to a userDetermines if the username is pushed to the app on updates for CUSTOM `type`Type of mapping expression.Embedded resources related to the app using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.<div class=\"x-lifecycle-container\"><x-lifecycle class=\"oie\"></x-lifecycle></div> Indicates which Express Configuration capabilities the app supports and has enabledThe Feature object is used to configure app feature settings.Key name of the feature | Feature name | Description | | --------- | ------------- | | USER_PROVISIONING | User profiles are pushed from Okta to the third-party app.The Application Group object that defines a group of users' app-specific profile and credentials for an appApplicationGroupAssignmentLinksApplicationLayoutApplicationLayoutRuleApplicationLayoutRuleConditionApplicationLayoutsApplicationLayoutsLinksLicenses for the appApp instance statusDiscoverable resources related to the appApp settingsThe entitlement management opt-in status for the appApp notes visible to either the admin or end userSpecifies notifications settings for the appSends customizable messages with conditions to end users when a VPN connection is requiredDefines network zones for VPN notificationSpecifies the VPN connection details required to access the appAuthentication mode for the app | signOnMode | Description | | ---------- | ----------- | | AUTO_LOGIN | Secure Web Authentication (SWA) | | BASIC_AUTH | HTTP Basic Authentication with Okta Browser Plugin | | BOOKMARK | Just a bookmark (no-authentication) | | BROWSER_PLUGIN | Secure Web Authentication (SWA) with Okta Browser Plugin | | OPENID_CONNECT | Federated Authentication with OpenID Connect (OIDC) | | SAML_1_1 | Federated Authentication with SAML 1.1 WebSSO (not supported for custom apps) | | SAML_2_0 | Federated Authentication with SAML 2.0 WebSSO | | SECURE_PASSWORD_STORE | Secure Web Authentication (SWA) with POST (plugin not required) | | WS_FEDERATION | Federated Authentication with WS-Federation Passive Requestor Profile | Select the `signOnMode` for your custom app:The type of client application.<div class=\"x-lifecycle-container\"><x-lifecycle class=\"oie\"></x-lifecycle></div> Universal Logout properties for the app.Indicates whether the app uses a shared identity stack that may cause the user to sign out of other apps by the same companyThe protocol used for Universal LogoutUniversal Logout status for the app instanceIndicates whether the app supports full or partial Universal Logout (UL).Specifies visibility settings for the appHides the app for specific end-user appsAppPropertiesValueAppResourceHrefObjectAppServiceAccountCredentials for a SaaS app accountAppServiceAccountForUpdateThe application user object defines a user's app-specific profile and credentials for an appIndicates if the assignment is direct (`USER`) or by group membership (`GROUP`).AppUserAssignRequestIndicates if the assignment is direct (`USER`) or by group membership (`GROUP`).Specifies a user's credentials for the app.Updates the assigned user credentialsThe user's password.Updates the assigned user profile > **Note:** The Okta API currently doesn't support entity tags for conditional updates.Status of an application userThe synchronization state for the application user.AppUserUpdateRequestAssignedAppLinkAssignGroupOwnerRequestBodyAssignRoleRequestAssignRoleToClient200ResponseAssignRoleToClientRequestSpecify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:AssignRoleToGroup200ResponseAssignRoleToGroupRequestSpecify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:AssignRoleToUser201ResponseAssignRoleToUserRequestSpecify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:Action that assigns a user to a realmAssociatedServerMediatedAssuranceMethodGets or Sets AssuranceMethodFactorModeAttackProtectionAuthenticatorSettingsAttestationRootCertificatesRequestInnerAttestationRootCertificatesResponseInnerAuthenticationMethodIndicates if any secrets or private keys used during authentication must be hardware protected and not exportable.Indicates if phishing-resistant Factors are required.Indicates if a user is required to be verified with a verification method.Gets or Sets userVerificationMethodsAuthenticationMethodChainAuthenticationMethodChainMethodAuthenticationMethodObjectSpecifies the authentication provider that validates the user's password credential.The type of authentication providerThe type of authentication providerSpecifies the authentication provider that validates the user password credential.AuthenticatorBaseAuthenticatorEnrollmentAuthenticatorEnrollmentCreateRequestAuthenticatorEnrollmentCreateRequestTacAuthenticatorEnrollmentLinksAuthenticatorEnrollmentPolicyAuthenticatorEnrollmentPolicyAuthenticatorSettingsConstraints for the authenticatorEnrollment requirements for the authenticatorRequirements for the user-initiated enrollmentA label that identifies the authenticatorSpecifies the conditions that must be met during policy evaluation to apply the policyIdentifies users and groups that are used togetherSpecifies a set of groups whose users are to be included or excludedAuthenticatorEnrollmentPolicyRuleSpecifies whether the user is to be enrolled the first time they `LOGIN`, the next time they are in the `CHALLENGE` process, or `NEVER`Gets or Sets selfAuthenticatorEnrollmentPolicyRuleActionsSpecifies conditions that must be met during policy evaluation to apply the rule.Identifies users and groups that are used togetherSpecifies a set of users to be included or excludedSpecifies the policy level settings > **Note:** In Identity Engine, the Multifactor (MFA) Enrollment policy name has changed to authenticator enrollment policy.Type of policy configuration object <x-lifecycle class=\"oie\"></x-lifecycle> The `type` property in the policy `settings` is only applicable to the authenticator enrollment policy available in Identity Engine.Represents a particular authenticator serving as a constraint on a methodAuthenticatorKeyCustomAppAuthenticatorKeyCustomAppAllOfProviderProvider typeThe configuration of the providerAuthenticatorKeyCustomAppAllOfProviderConfigurationApnsAuthenticatorKeyCustomAppAllOfProviderConfigurationFcmAuthenticatorKeyCustomAppAllOfSettingsAuthenticatorKeyDuoAuthenticatorKeyDuoAllOfProviderProvider typeAuthenticatorKeyDuoAllOfProviderConfigurationAuthenticatorKeyDuoAllOfProviderConfigurationUserNameTemplateAuthenticatorKeyEmailAuthenticatorKeyEmailAllOfSettingsA human-readable string that identifies the authenticatorAuthenticatorKeyExternalIdpAuthenticatorKeyGoogleOtpAuthenticatorKeyOktaVerifyAuthenticatorKeyOktaVerifyAllOfSettingsAuthenticatorKeyOnpremAuthenticatorKeyPasswordAuthenticatorKeyPhoneAuthenticatorKeyPhoneAllOfSettingsAuthenticatorKeySecurityKeyAuthenticatorKeySecurityQuestionAuthenticatorKeySmartCardAuthenticatorKeySymantecVipAuthenticatorKeyTac<x-lifecycle-container><x-lifecycle class=\"oie\"></x-lifecycle></x-lifecycle-container>Settings for the TAC authenticatorProvider typeDefine the configuration settings of the TACDefine the complexity of the TACAuthenticatorKeyWebauthnAuthenticatorKeyYubikeyAuthenticatorLinksGets or Sets AuthenticatorMethodAlgorithmAuthenticatorMethodBaseLimits the authenticators that can be used for a given method.Gets or Sets methodAuthenticatorMethodOtpGets or Sets AuthenticatorMethodPropertyAuthenticatorMethodPushAuthenticatorMethodPushAllOfSettingsAuthenticatorMethodSignedNonceAuthenticatorMethodSignedNonceAllOfSettingsAuthenticatorMethodSimpleAuthenticatorMethodTacAuthenticatorMethodTotpAuthenticatorMethodTotpAllOfSettingsGets or Sets AuthenticatorMethodTransactionTypeThe type of authenticator methodThe type of authenticator methodAuthenticatorMethodWebAuthnThe settings for the WebAuthn authenticator methodAuthenticatorMethodWithVerifiablePropertiesDefines the authenticator specific parametersDefines the authenticator specific parametersDefines the authenticator specific parametersAuthenticatorSimpleThe type of authenticatorAuthorizationServerAuthorizationServerCredentialsThe Key rotation mode for the authorization serverAuthorizationServerCredentialsSigningConfigHow the key is usedAuthorizationServerJsonWebKeyAuthorizationServerPolicySpecifies whether requests have access to this PolicyIndicates that the Policy is an authorization server PolicyAuthorizationServerPolicyAllOfLinksAuthorizationServerPolicyConditionsIdentifies Users and Groups that are used togetherAuthorizationServerPolicyRuleStatus of the ruleRule typeAuthorizationServerPolicyRuleActionsAuthorizationServerPolicyRuleConditionsSpecifies a set of Groups whose Users are to be includedAuthorizationServerPolicyRuleRequestStatus of the ruleRule typeSpecifies a set of Users to be includedAuthorizationServerResourceHrefObjectAuthServerLinksAuthSettingsGets or Sets AuthTypeThe org setting that automatically assigns the Okta Admin Console when an admin role is assignedAutoLoginApplicationAutoLoginApplicationSettingsThe entitlement management opt-in status for the appAutoLoginApplicationSettingsSignOnThe schedule of auto-update configured by the adminAvailableActionAvailableActionProviderAvailableActionsThe destination AWS region where your event source is locatedThis object contains a number of sub-objects, each of which provide some type of contextual information.Details of the user sessionIdentifies the Okta user that the token was generated to authenticate and provides details of their Okta user profileSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of the user.BaseContextUserProfileBaseEmailDomainBaseEmailServerBaseTokenThe tokenLifetime of the tokenBasicApplicationSettingsThe entitlement management opt-in status for the appBasicApplicationSettingsApplicationBasicAuthApplication`template_basic_auth` is the key name for a Basic Authentication scheme app instanceBeforeScheduledActionPolicyRuleConditionBehaviorRuleBehaviorRuleAnomalousDeviceBehaviorRuleAnomalousIPBehaviorRuleAnomalousLocationBehaviorRuleASNBehaviorRuleSettingsAnomalousASNBehaviorRuleSettingsAnomalousDeviceBehaviorRuleSettingsAnomalousIPBehaviorRuleSettingsAnomalousLocationBehaviorRuleSettingsHistoryBasedBehaviorRuleSettingsVelocityGets or Sets BehaviorRuleTypeBehaviorRuleVelocityThe method used to bind the out-of-band channel with the primary channel.BookmarkApplication`bookmark` is the key name for a Bookmark appBookmarkApplicationSettingsThe entitlement management opt-in status for the appBookmarkApplicationSettingsApplicationBouncesRemoveListErrorBouncesRemoveListObjBouncesRemoveListResultBrandDefines a list of domains with a subset of the properties for each domainBrandRequestBrandWithEmbeddedBrowserPluginApplicationThe key name for the app definitionBulkDeleteRequestBodyThe type of data to bulk delete in a session.BulkGroupDeleteRequestBodyBulkGroupMembershipsDeleteRequestBodyBulkGroupMembershipsUpsertRequestBodyBulkGroupUpsertRequestBodyBulkGroupUpsertRequestBodyProfilesInnerBulkUpsertRequestBodyThe type of data to upsert into the session.BulkUpsertRequestBodyProfilesInnerAn entitlement in a governance bundleLink relations availableEntitlement list for a governance bundleBundleEntitlementsResponseLinksLink to the bundle resourceByDateTimeAuthenticatorGracePeriodExpiryAn ISO 8601 formatted date and time for BY_DATE_TIME grace period type.A time duration specified as an [ISO 8601 duration](https://en.wikipedia.org/wiki/ISO_8601#Durations).The credential was created, changed, revoked or deletedThe type of action done towards the credentialThe credential type of the changed credential.The entity that initiated the eventCaepCredentialChangeEventReasonAdminCaepCredentialChangeEventReasonUserThe subject's device compliance was revokedCurrent device compliance statusThe entity that initiated the eventPrevious device compliance statusCaepDeviceComplianceChangeEventReasonAdminCaepDeviceComplianceChangeEventReasonUserCaepEventCaepSecurityEventThe entity that initiated the eventThe session of the subject was revokedThe entity that initiated the eventAttempts to activate a `call` factor with the specified passcodeVerifies an OTP sent by a `call` factor challenge.Determines whether Okta assigns a new app account to each user managed by Okta.Defines user import rulesRules for matching and creating usersDetermines the attribute to match usersDefines import settingsDefines the configuration for the INBOUND_PROVISIONING featureDefines the configurations for the USER_PROVISIONING featureDetermines whether updates to a user's profile are pushed to the appGets or Sets CapabilityCapability typeThe type of CAPTCHA providerAn app in the OIN catalogSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationApp statusGets or Sets ChallengeTypeDetermines whether a change in a user's password also updates the user's password in the appChangePasswordRequestThe out-of-band channel for use with authentication.ChannelBindingGets or Sets styleChildOrgEdition for the org.Status of the org.Type of returned `token`.Current version of the Chrome BrowserThe type of user classificationClientSpecifies which clients are included in the PolicyThe org setting that assigns the super admin role by default to a public client appGets or Sets CodeChallengeMethodComplianceConditions of applying realm assignmentThe signing key rotation setting for the provisioning connectionType of connection authentication methodContentSecurityPolicySettingGets or Sets modeContextPolicyRuleConditionCreateAIAgentRequestCreateBrandRequestCreateGroupPushMappingRequestCreateGroupRuleRequestGets or Sets typeCreateIamRoleRequestCreateOrUpdatePolicyCreateRealmAssignmentRequestCreateRealmRequestCreateResourceSetRequestCreateSessionRequestThe request body properties for the new UI SchemaCreateUpdateIamRolePermissionRequestCreateUserRequestThe ID of the user type.CredentialSyncInfoCurrent credential sync status of the privileged resourceCsrSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of a CSR object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.CsrMetadataCsrMetadataSubjectCsrMetadataSubjectAltNamesDescribes allowed HTTP verbs for the `href`Gets or Sets allowDescribes allowed HTTP verbs for the `href`Gets or Sets allowCustomAAGUIDCreateRequestObjectCustomAAGUIDResponseObjectCustomAAGUIDUpdateRequestObjectUser verification settingCustom authorization server for the managed connectionCustomAuthorizationServerLinksSet of AIPs used for authType `CUSTOM`CustomizablePageCustomRoleCustomRoleAssignmentSchemaSpecify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:DefaultAppDesktopMFAEnforceNumberMatchingChallengeOrgSettingDesktopMFARecoveryPinOrgSettingA key object with public key detailsGets or Sets DetectedRiskEventsDevice<x-lifecycle class=\"oie\"></x-lifecycle> Specifies the device condition to match onDeviceAssurance<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>Represents the remediation mode of this device assurance policy when users are denied access due to device noncomplianceDeviceAssuranceAndroidPlatformDeviceAssuranceAndroidPlatformAllOfDiskEncryptionTypeDeviceAssuranceAndroidPlatformAllOfScreenLockTypeSettings for third-party signal providers (based on the `ANDROID` platform)DeviceAssuranceChromeOSPlatformSettings for third-party signal providers (based on the `CHROMEOS` platform)DeviceAssuranceIOSPlatformSettings for third-party signal providers (based on the `IOS` platform)DeviceAssuranceMacOSPlatformDeviceAssuranceMacOSPlatformAllOfDiskEncryptionTypeSettings for third-party signal providers (based on the `MACOS` platform)DeviceAssuranceWindowsPlatformSettings for third-party signal providers (based on the `WINDOWS` platform)DeviceContextProviderIdentifies the type of device context providerWhether or not the device context provider is used to identify the user.Display name of the deviceDeviceIntegrationsThe metadata of the device integrationGets or Sets typeDeviceIntegrationsMetadataOneOfGets or Sets typeDeviceIntegrationsMetadataOneOf1Gets or Sets typeDeviceIntegrationsMetadataOneOf2Gets or Sets typeThe namespace of the device integrationGets or Sets DeviceIntegrationsPlatformThe status of the device integrationIndicates how well a device can enforce app integrityDeviceListList of associated users for the device if the `expand=user` query parameter is specified in the request.OS platform of the deviceGets or Sets DevicePolicyMDMFrameworkGets or Sets DevicePolicyPlatformTypeDevicePolicyRuleConditionSpecifies [device assurance policies](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/DeviceAssurance/) in the policy ruleDevicePolicyRuleConditionPlatformGets or Sets DevicePolicyTrustLevelDevicePostureCheck<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>Represents the Device Posture Checks configuration for the device assurance policyRepresents how the device posture check is rendered in device assurance policiesGets or Sets DevicePostureChecksPlatformRepresents the remediation instructions shown to the end user when the device posture check failsDevicePostureChecksRemediationSettingsLinkDevicePostureChecksRemediationSettingsMessageGets or Sets DevicePostureChecksType<x-lifecycle-container><x-lifecycle class=\"oie\"></x-lifecycle></x-lifecycle-container>Device Posture IdP providerDeviceProfileDeviceSignalCollectionPolicyDeviceSignalCollectionPolicyRule<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>Specifies actions to be taken, or operations that may be allowed, if the rule conditions are satisfied<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>Specifies conditions that must be met during policy evaluation to apply the rule.Specifies how device context is collected when a user attempts to sign inThe state object of the deviceDeviceUserThe management status of the deviceScreen lock type of the deviceAlgorithm used to generate the key.Gets or Sets DiskEncryptionTypeAndroidType of encryption used on the device > **Note:** The following values map to Disk Encryption ON: `FULL`, `USER`, `ALL_INTERNAL_VOLUMES`.Gets or Sets DiskEncryptionTypeDesktopDNS TXT record that must be registered for an RP ID domain that requires verification.DNS TXT and CNAME records to be registered for the DomainGets or Sets DNSRecordTypeAuthenticatorsGets or Sets DNSRecordTypeDomainsDefines the properties of the certificateCertificate metadata for the domainCertificate source type that indicates whether the certificate is provided by the user or Okta.Certificate typeDomainLinksDefines a list of domains with a subset of the properties for each domainDomainRequestThe properties that define an individual domain.Status of the domainStatus whether a domain has been failed over or notGoogle Chrome Device Trust Connector providerGoogle Chrome Device Trust Connector providerGoogle Chrome Device Trust Connector providerDurationDynamicNetworkZoneThe proxy type used for a Dynamic Network ZoneElliptic curve key in JSON Web Key (JWK) format.The elliptic curve protocolThe type of public keyThe intended use for the key.Attempts to activate an `email` factor with the specified passcodeVerifies an OTP sent by an `email` factor challenge.EmailContentEmailCustomizationEmailCustomizationAllOfLinksEmailDefaultContentEmailDomainEmailDomainDNSRecordGets or Sets EmailDomainDNSRecordTypeEmailDomainResponseEmailDomainResponseWithEmbeddedGets or Sets EmailDomainStatusEmailPreviewEmailPreviewLinksEmailServerPostEmailServerRequestEmailServerResponseEmailSettingsGets or Sets recipientsEmailSettingsResponseGets or Sets recipientsEmailSettingsResponseLinksEmailTemplateResponseEmailTemplateResponseEmbeddedEmailTemplateResponseLinksVariant for email templates.EmailTestAddressesThe Public Key Details are defined in the `_embedded` property of the Key object.Gets or Sets enabledPagesTypeSetting statusRequested authentication method for OAuth 2.0 endpoints.Variant for the Okta End-User Dashboard.EnhancedDynamicNetworkZoneThe list of ASNs associated with an Enhanced Dynamic Network ZoneIP services, such as a proxy or VPN, to include or exclude for an Enhanced Dynamic Network ZoneThe list of geolocations to include or exclude for an Enhanced Dynamic Network ZoneEnrollment Initialization RequestName of the fulfillment provider for the WebAuthn preregistration factorEnrollment initialization responseName of the fulfillment provider for the WebAuthn preregistration factorEnrollment initialization requestName of the fulfillment provider for the WebAuthn preregistration factorYubico transport key in the form of a JSON Web Token (JWK), used to encrypt our fulfillment request to Yubico.Name of the fulfillment provider for the WebAuthn preregistration factor<x-lifecycle-container><x-lifecycle class=\"oie\"></x-lifecycle></x-lifecycle-container>Specifies the time period required to complete an authenticator enrollment or setupGrace period typeLink to the entitlements resourceEntitlementTypesInnerAttributes for the entitlement typeThe property mapping between an Okta entitlement and an app entitlementEntitlementValueSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationEntitlementValuesResponseEntitlementValuesResponseLinksEntityRiskPolicyEntityRiskPolicyRuleEntityRiskPolicyRuleActionRunWorkflowGets or Sets actionThis action runs a workflowEntityRiskPolicyRuleActionsObjectGets or Sets actionEntityRiskPolicyRuleActionTerminateAllSessionsThis action revokes or terminates all of the user's active sessions.The action to take based on the risk eventThe object that contains the `actions` arrayEntityRiskPolicyRuleConditions<x-lifecycle class=\"oie\"></x-lifecycle> The risk score level of the entity risk policy ruleGets or Sets levelErrorConflict error objectErrorCauseDetails about an error that occurred during the operationErrorPageVariant for the error page.EventHookStatus of the event hookEventHookChannelEventHookChannelConfigThe authentication scheme used for this request.The authentication scheme type.EventHookChannelConfigHeaderThe channel type.EventHookFilterMapObjectEventHookFilterMapObjectConditionThe optional filter defined on a specific event type > **Note:** Event hook filters is a [self-service Early Access (EA)](/openapi/okta-management/guides/release-lifecycle/#early-access-ea) to enable.EventHookLinksVerification status of the event hook.EventSubscriptionsThe events object type.ExecuteInlineHook200ResponseExecuteInlineHookRequestConditional expressionFailbackRequestSchemaFailoverRequestSchemaFCMConfigurationFCMPushProviderSpecifies feature release cycle informationGets or Sets FeatureLifecycleFeatureLinksLink to feature dependenciesLink to feature dependentsCurrent release cycle stage of a feature If a feature's stage value is `EA`, the state is `null` and not returned.Indicates the release state of the featureCurrent release stage of the featureType of featureFederatedClaimFederatedClaimRequestBodyGets or Sets FipsEnumForgotPasswordResponseInformation about the fulfillment order that includes the factor’s make and model, the custom configuration of the factor, and inventory details.Fulfillment requestName of the fulfillment provider for the WebAuthn preregistration factorGetJwk200ResponseCryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web KeyGetSsfStreams200ResponseThe Subject Identifier format expected for any SET transmitted.Schema for the Google Workspace app (key name: `google`) To create a Google Workspace app, use the [Create an Application](https://developer.okta.com/docs/api/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeGoogleApplicationSettingsThe entitlement management opt-in status for the appGoogle app instance propertiesGovernanceBundleRequest to create a governance bundleLink relations availableGovernanceBundlesResponseGovernanceBundlesResponseLinksRequest to update a governance bundleThe grant type<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>Represents the Grace Period configuration for the device assurance policyRepresents the type of Grace Period configured for the device assurance policyGracePeriodExpiryStatusGrantResourcesHrefObjectDetermines the mechanism Okta uses to authorize the creation of the tokens.Array of grant types that this condition includes.GroupSpecifies a set of groups whose users are to be included or excludedEmbedded resources related to the groupIf the group is sourced from an app, this object contains information about that appStatistics about the group[Discoverable resources](/openapi/okta-management/management/tag/Group/#tag/Group/operation/listGroups!GroupMembershipsRequestSchemaGroupMembershipsResponseSchemaGroupOwnerThe source where group ownership is managedThe entity type of the ownerSpecifies a set of groups whose users are to be included or excludedSpecifies required and optional properties for a group.The object class typeGroupPushMappingDiscoverable resources related to the group push mappingThe status of the group push mappingThe status of the group push mappingGroupRuleDefines which users and groups to assignDefines group rule conditionsDefines Okta specific [group-rules expression](https://developer.okta.com/docs/reference/okta-expression-language/#expressions-in-group-rules)Contains the `groupIds` arrayCurrently not supportedDefines conditions for `people` in a group ruleStatus of group rule.Defines conditions specific to user exclusionGroupSchemaGroupSchemaAttributeGroupSchemaAttributeEnumInnerGroupSchemaBaseAll Okta-defined profile properties are defined in a profile subschema with the resolution scope `#base`.All custom profile properties are defined in a profile subschema with the resolution scope `#custom`GroupSchemaDefinitionsLink to the [Application Groups](/openapi/okta-management/management/tag/ApplicationGroups/#tag/ApplicationGroups/operation/listApplicationGroupAssignments) resourceGroupsRequestSchemaGroupsResponseSchemaThe profile information of the groupDetermines how a group's profile and memberships are managedLink to the app help resourceThe `id` property in the response as `id` serves as the unique ID for the key, which you can specify when invoking other CRUD operations.HostedPageGets or Sets HostedPageTypeLink to publish CSRLink to the resource (self)Describes allowed HTTP verbs for the `href`Describes allowed HTTP verbs and guidance for the `href`HrefObjectLink to activate the resourceLink to the app resourceLink to the assignee resourceLink to authorize scopesLink to the binding resourceLink to the bindings resourceLink to the client resourceLink to deactivate the resourceLink to delete the resourceLink to the resourcesLink to grant Okta Aerial access to your OrgLink to the group resourceLink to the logo resourceLink to the mappings resourceLink to the member resourceLink to the members resourceLink to the next resourceLink to the permissions resourceLink to the resource set resourceLink to resource set resourcesLink to retrieve Okta Aerial consent for your OrgLink to revoke Okta Aerial consent for your OrgLink to the role resourceLink to the rules resourceLink to the resource (self)Link to suspend the resourceLink to unsuspend the resourceLink to the user resourceGets or Sets HttpMethodAn entitlement in a governance bundleIamRoleIamRoleLinksIamRolesIdentity assertion connection for an app instanceType of connection authentication methodThe authentication protocol type used for the connectionCreate an identity assertion connection for an app instanceType of connection authentication methodThe authentication protocol type used for the connectionReference to an app instance in [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) formatIdentity assertion connection for a custom authorization serverType of connection authentication methodThe authentication protocol type used for the connectionCreate an identity assertion connection for a custom authorization serverType of connection authentication methodThe authentication protocol type used for the connectionReference to a custom authorization server and its configurationIdentityProviderIdentityProviderApplicationUserIdentityProviderApplicationUserLinksIndicates whether Okta uses the original Okta org domain URL or a custom domain URL in the request to the social IdPIdentityProviderLinksPolicy settings for the IdP.Gets or Sets IdentityProviderPolicyProviderSpecifies the IdP that's used to sign inThe properties in the IdP `properties` object vary depending on the IdP typeGets or Sets additionalAmrMetadata about the IDV vendor.IdP-specific protocol settings for endpoints, bindings, and algorithms used to connect with the IdP and validate messagesSAML 2.0 protocolThe IdP object's `type` property identifies the social or enterprise IdP used for authentication.IdentitySourceGroupMembershipsDeleteProfileInnerIdentitySourceGroupMembershipsUpsertProfileInnerContains a set of external group attributes and their values that are mapped to Okta standard properties.IdentitySourceSessionThe current status of the identity source sessionIdentitySourceUserProfileForDeleteContains a set of external user attributes and their values that are mapped to Okta standard and custom profile properties.IdPCertificateCredentialDefines a CSR for a signature or decryption credential for an IdPIdPCsrLinksIdpDiscoveryPolicyIdpDiscoveryPolicyRuleSpecifies conditions that must be met during policy evaluation to apply the rule.A [JSON Web Key](https://tools.ietf.org/html/rfc7517) for a signature or encryption credential for an IdPSpecifies where to route users when they are attempting to sign in to your org, if the rule conditions are satisfied.Specifies IdP settingsIdpPolicyRuleActionMatchCriteriaIdpPolicyRuleActionProviderIdProofingMethodDetermines whether the rule should use expression language or a specific IdP<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>JWE alg algorithm for encrypting the ID token issued to this client.IDV authorization endpointGets or Sets bindingCredentials for verifying requests to the IDV vendorClient credential for `IDV_PERSONA` IdP type<x-lifecycle-container><x-lifecycle class=\"oie\"></x-lifecycle></x-lifecycle-container>Client credentials for `IDV_CLEAR` and `IDV_INCODE` IdP typesContains endpoints for the IDV vendor.IDV [PAR](https://datatracker.ietf.org/doc/html/rfc9126) endpointGets or Sets bindingToken endpoint of the IDV vendorGets or Sets bindingGets or Sets IframeEmbedScopeAllowedAppsImageUploadResponseImport schedule configurationImportScheduleSettingsDetermines the Okta username for the imported userDetermines the username format when users sign in to OktaInactivityPolicyRuleConditionInboundProvisioningApplicationFeatureAn inline hook object that specifies the details of the inline hookInlineHookBasePayloadInlineHookChannelProperties of the communications channel that are used to contact your external serviceThe authentication scheme to use for this requestThe authentication scheme to use for this requestProperties of the communications channel that are used to contact your external serviceInlineHookChannelConfigHeadersInlineHookChannelCreateInlineHookChannelHttpInlineHookChannelHttpCreateInlineHookChannelOAuthInlineHookChannelOAuthCreateGets or Sets InlineHookChannelTypeAn inline hook object that specifies the details of the inline hookAn inline hook object that specifies the details of the inline hookInlineHookHttpConfigInlineHookHttpConfigCreateInlineHookLinksInlineHookLinksCreateInlineHookOAuthBasicConfigInlineHookOAuthChannelConfigInlineHookOAuthChannelConfigCreateInlineHookOAuthClientSecretConfigInlineHookOAuthClientSecretConfigCreateInlineHookOAuthPrivateKeyJwtConfigAn inline hook object that specifies the details of the inline hookThe API request that triggered the inline hookThe URL of the API endpointInlineHookResponseInlineHookResponseCommandsInlineHookResponseCommandValueGets or Sets InlineHookStatusOne of the inline hook typesInlineObjectInlineObject1InlineObject1ResultsInnerInlineObject2InlineObjectResultsInnerInterclientTrustMappingInterclientTrustMappingRequestBodyIPNetworkZoneAn IP service offered by a provider, such as a proxy or VPNGets or Sets IssuerModeThe update actionJsonWebKeyThe status of the public keyThe type of public keyThe intended use of the public keyJwkUsePurpose of the certificate.KeepCurrent<x-lifecycle-container><x-lifecycle class=\"oie\"></x-lifecycle></x-lifecycle-container>Controls how often the post-authentication prompt is presented to usersWhether the post-authentication [Keep Me Signed In (KMSI)](https://help.okta.com/oie/en-us/content/topics/security/stay-signed-in.htm) flow is allowedKeyRequestRepresents the attestation strength used by the Chrome Verified Access APIRepresents the attestation strength used by the Chrome Verified Access APIKnowledgeConstraintGets or Sets methodsGets or Sets typesDetermines whether to update a user in the app when a user in Okta is updatedDetermines whether deprovisioning occurs when the app is unassignedLifecycleExpirationPolicyRuleConditionGets or Sets LifecycleStatusLinkedHrefObjectLinkedObjectLinkedObjectDetailsThe object type for this relationshipSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LinksActivateLinksAerialConsentGrantedLinksAerialConsentRevokedSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LinksAuthenticatorLinksCancelSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LinksDeactivateLinksEnrollLinksFactorSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the resources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the sources using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LinksPollLinksQrcodeLinksQuestionsLinksResendSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LinksSelfAndFullUsersLifecycleLinksSelfAndLifecycleLinksSelfAndRolesSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LinksSelfLifecycleAndAuthorizeLinksSendLinksUserAuthenticatorsLinksUserFactorsLinksUserRefLinksVerifyListGroupAssignedRoles200ResponseInnerListJwk200ResponseInnerCryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web KeyA collection of the profile mappings that include a subset of the profile mapping object's properties.ListRolesForClient200ResponseInnerListSubscriptionsRoleRoleRefParameterVariant for the Okta loading page.Gets or Sets LocationGranularityDescribes the user, app, client, or other entity (actor) who performs an action on a target.All authentication relies on validating one or more credentials that prove the authenticity of the actor's identity.The system that proves the identity of an actor using the credentials provided to itWhen an event is triggered by an HTTP request, the `client` object describes the [client](https://datatracker.ietf.org/doc/html/rfc2616) that issues the HTTP request.A credential provider is a software service that manages identities and their associated credentials.The underlying technology/scheme used in the credentialFor some kinds of events (for example, OLM provisioning, sign-in request, second factor SMS, and so on), the fields that are provided in other response objects aren't sufficient to adequately describe the operations that the event has performed.The entity that describes a device enrolled with passwordless authentication using Okta Verify.Gets or Sets LogDiskEncryptionTypeLogEventGeographical context describes a set of geographic coordinates.The latitude and longitude of the geolocation where an action was performed.LogIpAddressDescribes the issuer of the authorization server when the authentication is performed through OAuth.LogOutcomeResult of the actionThe `Request` object describes details that are related to the HTTP request that triggers this event, if available.Gets or Sets LogScreenLockTypeThe `securityContext` object provides security information that is directly related to the evaluation of the event's IP reputation.Indicates how severe the event isLogStreamLifecycle status of the log stream objectLink to activate the resourceHTTP method allowed for the resourceLogStreamAwsLogStreamAwsPutSchemaLink to deactivate the resourceHTTP method allowed for the resourceLogStreamLinkObjectHTTP method allowed for the resourceSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.LogStreamPutSchemaLogStreamSchemaLink to the resource (self)HTTP method allowed for the resourceSpecifies the configuration for the `aws_eventbridge` log stream type.Specifies the configuration for the `splunk_cloud_logstreaming` log stream type.Specifies the configuration for the `splunk_cloud_logstreaming` log stream type.LogStreamSplunkLogStreamSplunkPutSchemaSpecifies the streaming provider used Supported providers: * `aws_eventbridge` ([AWS EventBridge](https://aws.amazon.com/eventbridge)) * `splunk_cloud_logstreaming` ([Splunk Cloud](https://www.splunk.com/en_us/software/splunk-cloud-platform.html)) Select the provider type to see provider-specific configurations in the `settings` property:LogTargetDetails on the target's changes.A `transaction` object comprises contextual information associated with its respective event.\"A user agent is software (a software agent) that is acting on behalf of a userManagedConnectionType of connection authentication methodThe authentication protocol type used for the connectionApp instance for the managed connectionCreate a new connectionType of connection authentication methodThe authentication protocol type used for the connectionManagedConnectionListLinks available in managed list responseUpdate an existing managed connection.Determines how Okta evaluates requested scopes for the connection.Service account for the managed connectionThe status of the connectionSecret for the managed connectionGets or Sets MDMEnrollmentPolicyEnrollmentMDMEnrollmentPolicyRuleConditionMembershipRequestSchemaLink to the [SAML metadata](/openapi/okta-management/management/tag/ApplicationSSO/#tag/ApplicationSSO/operation/previewSAMLmetadataForApplication) for SSOCertificate chain description for verifying assertions from the Smart CardMtlsEndpointsThe Single Sign-On (SSO) endpoint is the IdP's `SingleSignOnService` endpointMtlsTrustCredentialsMechanism to validate the certificate > **Note:** This property isn't supported.NetworkZoneSpecifies the value of an IP address expressed using either `range` or `CIDR` form.Format of the IP addressesNetworkZoneLocationNetwork Zone statusThe type of Network ZoneThe usage of the Network ZoneThe type of notificationContains the `challenge` and `correctAnswer` objects for `push` factors that use a number matching challengeNumber matching challenge for a `push` factorUser that created the objectOAuth2ClaimSpecifies the scopes for the ClaimSpecifies the type of group filter if `valueType` is `GROUPS` If `valueType` is `GROUPS`, then the groups returned are filtered according to the value of `group_filter_type`.Specifies whether the Claim is for an access token (`RESOURCE`) or an ID token (`IDENTITY`)Specifies whether the Claim is an Okta Expression Language (EL) expression (`EXPRESSION`), a set of groups (`GROUPS`), or a system claim (`SYSTEM`)OAuth2Client<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.Cryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web Key<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>A [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.Cryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web KeyA [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.Cryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web KeyA [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.Cryptographic algorithm family for the certificate's key pairStatus of the OAuth 2.0 client JSON Web KeyAcceptable use of the JSON Web KeyAn EC signing keyThe cryptographic curve used with the keyAn EC signing keyThe cryptographic curve used with the keyOAuth2ClientJsonWebKeyRequestBaseStatus of the OAuth 2.0 client JSON Web KeyOAuth2ClientJsonWebKeyRequestBodyStatus of the OAuth 2.0 Client JSON Web KeyOAuth2ClientJsonWebKeyResponseBaseAn RSA signing keyAn RSA signing keyOAuth2ClientLinksOAuth2ClientSecretStatus of the OAuth 2.0 Client SecretOAuth2ClientSecretRequestBodyStatus of the OAuth 2.0 Client SecretOAuth2RefreshTokenThe embedded resources related to the object if the `expand` query parameter is specifiedOAuth2RefreshTokenLinksLink to revoke the refresh TokenOAuth2RefreshTokenLinksAllOfRevokeAllOfHintsGets or Sets allowOAuth2RefreshTokenScopeSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.OAuth2ResourceServerJsonWebKeyThe status of the encryption key.OAuth2ResourceServerJsonWebKeyRequestBodyStatus of the JSON Web KeyOAuth2ScopeGrant object that represents an app consent scope grantEmbedded resources related to the GrantOAuth2ScopeConsentGrantEmbeddedScopeOAuth2ScopeConsentGrantLinksUser type source that granted consentIndicates whether a consent dialog is needed for the ScopeIndicates whether the Scope is included in the metadataArray of scopes that the condition includesOAuth 2.0 configuration used for authType `OAUTH2`OAuth2TokenOAuthApplicationCredentialsEndpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18)Specifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of an application using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Client authentication credentials for an [OAuth 2.0 Authorization Server](https://tools.ietf.org/html/rfc6749#section-2.3)OAuth 2.0 and OpenID Connect Client object > **Note:** You must complete client registration with the IdP Authorization Server for your Okta IdP instance to obtain client credentials.Client authentication methods supported by the token endpointRequested authentication method for the token endpointThe `OAUTH2` and `OIDC` protocols support the `authorization` and `token` endpoints.OAuthMetadataGets or Sets dpopSigningAlgValuesSupportedApplication name for the provisioning connectionSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the current status of a JSON Web Key using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specification.Array of OAuth 2.0 response type stringsEndpoint for an [OAuth 2.0 Authorization Server (AS)](https://tools.ietf.org/html/rfc6749#page-18)Schema for the Microsoft Office 365 app (key name: `office365`) To create a Microsoft Office 365 app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeOffice365ApplicationSettingsThe entitlement management opt-in status for the appOffice365 app instance propertiesSettings required for the Microsoft Office 365 provisioning connectionOfflineAccessScopeResourceHrefObjectOIDC configuration detailsOidcAlgorithmsEndpoint for the JSON Web Key Set (JWKS) document.Algorithm settings used to sign an authorization requestSignature Algorithm settings for signing authorization requests sent to the IdP > **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`).Advanced settings for the OpenID Connect protocolGets or Sets OidcSigningAlgorithmOIDC IdP logout endpointEndpoint for getting identity information about the user.OINApplicationContains SAML 1.1 sign-on mode attributesContains SAML 2.0 sign-on mode attributes.Profile for a group that is imported from Active Directory.The object class typeThe device risk level changedCurrent risk level of the deviceThe entity that initiated the eventPrevious risk level of the deviceIP changed for the subject's sessionThe entity that initiated the eventDefines a list of Okta Personal settings that can be enabled or disabled for the orgOktaSignOnPolicyOktaSignOnPolicyConditionsIndicates if the User should be challenged for a second factor (MFA) based on the device being used, a Factor session lifetime, or on every sign-in attempt > **Note:** Required only if `requireFactor` is set to `true`.OktaSignOnPolicyRuleOktaSignOnPolicyRuleActionsOktaSignOnPolicyRuleConditionsSpecifies settings for the policy ruleIndicates if a user is allowed to sign in<x-lifecycle class=\"oie\"></x-lifecycle> Indicates the primary factor used to establish a session for the org.Properties governing the user's session lifetimeStatus of Okta Support accessOktaSupportCaseAllows the Okta Support team to sign in to your org as an admin and troubleshoot issuesOktaSupportCasesCustomer allows Okta Support access to self-assigned cases.Profile for any group that is not imported from Active Directory.The object class typeThe user risk level changedCurrent risk level of the userThe entity that initiated the eventPrevious risk level of the userCredentials for an Okta userOpenIdConnectApplication`oidc_client` is the key name for an OAuth 2.0 client app instanceIndicates whether user consent is required or implicit.The type of IdP-initiated sign-in flow that the client supportsThe mode to use for the IdP-initiated sign-in flow.Indicates whether the Okta authorization server uses the original Okta org domain URL or a custom domain URL as the issuer of the ID token for this clientThe network restrictions of the clientThe connection type of the network.OpenIdConnectApplicationSettingsThe entitlement management opt-in status for the appOpenIdConnectApplicationSettingsClientThe signing algorithm for Client-Initiated Backchannel Authentication (CIBA) signed requests using JWT.The delivery mode for Client-Initiated Backchannel Authentication (CIBA).The type of JSON Web Key Set (JWKS) algorithm that must be used for signing request objectsType of the subjectIndicates if the client is allowed to use wildcard matching of `redirect_uris`A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for validating JWTs presented to Okta or for encrypting ID tokens minted by Okta for the clientRefresh token configuration for an OAuth 2.0 client When you create or update an OAuth 2.0 client, you can configure refresh token rotation by setting the `rotation_type` and `leeway` properties.The type of client app Specific `grant_types` are valid for each `application_type`.The refresh token rotation mode for the OAuth 2.0 clientOperational status of a given agentOperationRequestOperationResponseThe status of the asynchronous operationOptInStatusResponseThe entitlement management opt-in status for the Admin ConsoleLink relations availableSchema for the Okta Org2Org app (key name: `okta_org2org`) To create an Org2Org app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeOrg2OrgApplicationSettingsThe entitlement management opt-in status for the appOrg2Org app instance propertiesOnly used for the Okta Org2Org (`okta_org2org`) app.OrgAerialConsentOrgAerialConsentDetailsOrgAerialConsentRevokedOrgAerialGrantNotFoundOrganizationalUnitOrg billing contactSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org billing contact type object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationLink relations for the CAPTCHA settings objectType of contactOrgContactTypeObjOrgContactUserSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the contact type user object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationProfile and credential information for the first super admin user of the child org.Specifies primary authentication and recovery credentials for a user.Specifies a password for a user > **Note:** For information on defaults and configuring your password policies, see [Configure the password authenticator](https://help.okta.com/okta_help.htm?Specifies the profile attributes for the first super admin user.Connection object for Cross App Access connectionsIndicates if the Cross App Access connection is active or inactivePatch request object for Cross App Access ConnectionsRequested value of Cross App Access connection statusSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationOrgOktaCommunicationSettingSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationStatus of Okta Support SettingsOrgOktaSupportSettingsObjSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the Okta Support Settings object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationOrgPreferencesSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationOrgSettingStatus of orgOrg technical contactSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for the org technical Contact Type object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationSpecifies the OS requirement for the policy.OSVersionConstraintIndicates the Windows major versionContains the necessary properties for a dynamic Windows version requirementIndicates the type of the dynamic Windows version requirement<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>Contains the necessary properties for a dynamic version requirementIndicates the type of the dynamic OS version requirementCurrent version of the operating system (maximum of four components in the versioning scheme)Current version of the operating system (maximum of three components in the versioning scheme)The protocol usedHMAC algorithmThe shared secret encodingPageRootPageRootEmbeddedPageRootLinksAttributes used for processing Active Directory group membership updateThe update action to takeSpecifies a password for a user.Specifies a hashed password to import into Okta.The algorithm used to generate the hash using the password (and salt, when applicable).Specify a [password import inline hook](/openapi/okta-management/management/tag/InlineHook/#tag/InlineHook/operation/createPasswordImportInlineHook) to trigger verification of the user's password the first time the user signs in.Weak password dictionary lookup settingsLookup settings for commonly used passwordsPasswordExpirationPolicyRuleConditionPasswordImportRequestPasswordImportRequestDataThis object specifies the default action Okta is set to take.PasswordImportRequestDataContextPasswordImportRequestDataContextCredentialPassword import inline hook requestPassword import inline hook responsePasswordImportResponseCommandsInnerThe parameter value of the command. * To indicate that the supplied credentials are valid, supply a type property set to `com.okta.action.update` together with a value property set to `{\"credential\": \"VERIFIED\"}`. * To indicate that the supplied credentials are invalid, supply a type property set to `com.okta.action.update` together with a value property set to `{\"credential\": \"UNVERIFIED\"}`.Gets or Sets credentialPasswordPolicySpecifies an authentication provider that's the source of some or all usersGets or Sets PasswordPolicyAuthenticationProviderTypeSpecifies the conditions that must be met during policy evaluation to apply the policySpecifies how to handle password delegationPasswordPolicyDelegationSettingsOptionsSpecifies the password settings for the policyAge settingsBreached Protection settingsComplexity settingsLockout settingsPasswordPolicyRecoveryEmailPasswordPolicyRecoveryEmailPropertiesPasswordPolicyRecoveryEmailRecoveryTokenSettings for the factors that can be used for recoveryPasswordPolicyRecoveryFactorSettingsPasswordPolicyRecoveryQuestionPasswordPolicyRecoveryQuestionComplexityPasswordPolicyRecoveryQuestionPropertiesSpecifies the password recovery settings for the policy > **Note:** With Identity Engine, you can specify recovery factors inside the password policy rule instead of in the policy settings object.PasswordPolicyRuleIndicates if a password can be changedPasswordPolicyRuleActionsSpecifies conditions that must be met during policy evaluation to apply the rule.Specifies the policy level settingsIndicates whether the Password Protection Warning feature is enabledDetermines whether Okta creates and pushes a password in the app for each assigned userThe operation (PATCH action)Partial update for AI agent profileJSON Merge Patch for AI agent.Gets or Sets PerClientRateLimitModeA map of Per-Client Rate Limit Use Case to the applicable PerClientRateLimitMode.PermissionConditions for further restricting a permission.PermissionLinksPermissions assigned to the roleDefines a list of email domains with a subset of the properties for each domainPin requestName of the fulfillment provider for the WebAuthn preregistration factorThe Okta authentication pipeline of the orgGets or Sets PlatformPlatformConditionEvaluatorPlatformPlatformConditionEvaluatorPlatformOperatingSystemPlatformConditionEvaluatorPlatformOperatingSystemVersionGets or Sets PlatformConditionOperatingSystemVersionMatchTypeSpecifies a particular platform or device to match onIndicates if Google Play Protect is enabled on the device and whether it has found known malwarePolicyGets or Sets PolicyAccessSpecifies the behavior for linking an IdP user to an existing Okta userSpecifies the account linking action for an IdP userSpecifies filters on which users are available for account linking by an IdPGroup memberships used to determine link candidatesFilters on which users are available for account linkingPolicyCommonPolicyContextPolicyContextDeviceAn array of Group IDs for the simulate operation.The risk rule condition levelGets or Sets levelThe user ID for the simulate operation.The zone ID under the network rule condition.PolicyLinksPolicyMappingPolicyMappingLinksPolicyMappingRequestSpecifies the type of resource to map.Specifies a network selection mode and a set of network zones to be included or excluded.Network selection modeIdentifies users and groups that are used togetherGets or Sets PolicyPlatformOperatingSystemTypeGets or Sets PolicyPlatformTypePolicyRulePolicyRuleActionsEnrollGets or Sets PolicyRuleActionsEnrollSelfSpecifies an authentication entry pointSpecifies how the user is authenticatedPolicyRuleConditionsRule typeVerification method typeSpecifies the behavior for establishing, validating, and matching a username for an IdP userDetermines the Okta user profile attribute match conditions for account linking and authentication of the transformed IdP usernameAll Okta orgs contain only one IdP discovery policy with an immutable default rule routing to your org's sign-in page, one entity risk policy, and one session protection policy.Gets or Sets PolicyTypeSimulation[Okta Expression Language (EL) expression](https://developer.okta.com/docs/reference/okta-expression-language/) to generate or transform a unique username for the IdP user. * IdP user profile attributes can be referenced with the `idpuser` prefix such as `idpuser.subjectNameId`. * You must define an IdP user profile attribute before it can be referenced in an Okta EL expression.Gets or Sets PolicyUserStatusPossessionConstraintIndicates if device-bound Factors are required.Indicates if any secrets or private keys used during authentication must be hardware protected and not exportable.Gets or Sets methodsIndicates if phishing-resistant Factors are required.Gets or Sets typesIndicates if the user needs to approve an Okta Verify prompt or provide biometrics (meets NIST AAL2 requirements).Indicates the user interaction requirement (PIN or biometrics) to ensure verification of a possession factorGets or Sets userVerificationMethodsPostAPIServiceIntegrationInstancePostAPIServiceIntegrationInstanceRequestPostAuthKeepMeSignedInPromptPostAuthSessionFailureActionsObjectGets or Sets actionPostAuthSessionPolicyPostAuthSessionPolicyRuleThe action to take in response to a failure of the reevaluated global session policy or authentication policesThis object contains a `failureActions` array that defines the specific action to take when the session protection policy detects a failureSpecifies conditions that must be met during policy evaluation to apply the rule.PostAuthSessionPolicyRuleRunWorkflowGets or Sets actionPostAuthSessionPolicyRuleTerminateSessionThe action to take when the session protection policy detects a failure.PotentialConnectionType of connection authentication methodThe authentication protocol type used for the connectionPotentialConnectionListLinks available for the potential connection listPreRegistrationInlineHookThe type of principal, either an API token or an OAuth 2.0 appBase class for PrivilegedResourceRequest and PrivilegedResourceResponsePrivilegedResourceAccountAppRequestPrivilegedResourceAccountAppResponsePrivilegedResourceAccountOktaCredentials for the privileged resourcePrivilegedResourceFiltersCurrent status of the privileged resourceThe type of the resourceUpdate request for a privileged resourceProfileEnrollmentPolicyProfileEnrollmentPolicyRuleProfileEnrollmentPolicyRuleActionIndicates if the user profile is granted access > **Note:** You can't set the `access` property to `DENY` after you create the policyProgressive profile enrollment helps evaluate the user profile policy at every user login.Which action should be taken if this user is newProfileEnrollmentPolicyRuleActionsContains a single Boolean property that indicates whether `emailVerification` should occur (`true`) or not (`false`, default)ProfileEnrollmentPolicyRuleProfileAttributeThe profile mapping object describes a mapping between an Okta user's and an app user's properties using [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04).A target property, in string form, that maps to a valid [JSON Schema Draft](https://tools.ietf.org/html/draft-zyp-json-schema-04) document.Indicates whether to update target properties for user create and update or just for user create. - Having a pushStatus of `PUSH` causes properties in the target to be updated on create and update. - Having a pushStatus of `DONT_PUSH` causes properties in the target to be updated only on create.The updated request body propertiesThe parameter is the source of a profile mapping and is a valid [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04) document with the following properties.The parameter is the target of a profile mapping and is a valid [JSON Schema Draft 4](https://datatracker.ietf.org/doc/html/draft-zyp-json-schema-04) document with the following properties.This setting determines whether a user in the app gets updated when they're updated in Okta.Gets or Sets ProtocolSpecifies whether to digitally sign authorization requests to the IdPSpecifies whether to verify responses from the IdPGets or Sets ProtocolEndpointBindingProtocol settings for the IDV vendorID verification protocolProtocol settings for the [MTLS Protocol](https://tools.ietf.org/html/rfc5246#section-7.4.4)Mutual TLSProtocol settings for authentication using the [OAuth 2.0 Authorization Code flow](https://tools.ietf.org/html/rfc6749#section-4.1)OAuth 2.0 Authorization Code flowProtocol settings for authentication using the [OpenID Connect Protocol](http://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth)OpenID Connect Authorization Code flowProtocol settings for the [SAML 2.0 Authentication Request Protocol](http://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf)SAML 2.0 protocolThe authentication protocol type used for the connectionGets or Sets ProviderTypeSpecifies the behavior for just-in-time (JIT) provisioning of an IdP user as a new Okta user and their group membershipsSpecifies the user provisioning action during authentication when an IdP user isn't linked to an existing Okta user. * To successfully provision a new Okta user, you must enable just-in-time (JIT) provisioning in your org security settings. * If the target username isn't unique or the resulting Okta user profile is missing a required profile attribute, JIT provisioning may fail. * New Okta users are provisioned with either a `FEDERATION` or `SOCIAL` authentication provider depending on the IdP type.Conditional behaviors for an IdP user during authenticationDefines the method of authenticationOAuth 2.0 is used to authenticate with the app.ProvisioningConnectionOauthRequestProvisioningConnectionOauthRequestProfileThe app provisioning connection profile used to configure the method of authentication and the credentials.Gets or Sets ProvisioningConnectionRequestAuthSchemeProvisioningConnectionResponseProvisioningConnectionResponseProfileProvisioning connection statusA token is used to authenticate with the app.ProvisioningConnectionTokenRequestProvisioningConnectionTokenRequestProfileSpecifies the action during authentication when an IdP user is linked to a previously deprovisioned Okta userBehavior for a previously deprovisioned IdP user during authentication.Supported provisioning configurations for your integrationFeatureProvisioning settings for a user's group membershipsProvisioning action for the IdP user's group memberships | Enum | Description | Existing OKTA_GROUP Memberships | Existing APP_GROUP Memberships | Existing BUILT_IN Memberships | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- | ------------------------------ | ----------------------------- | | `APPEND` | Adds a user to any group defined by the IdP as a value of the `sourceAttributeName` array that matches the name of the allow listed group defined in the `filter` | Unchanged | Unchanged | Unchanged | | `ASSIGN` | Assigns a user to groups defined in the `assignments` array | Unchanged | Unchanged | Unchanged | | `NONE` | Skips processing of group memberships | Unchanged | Unchanged | Unchanged | | `SYNC` | Group memberships are sourced by the IdP as a value of the `sourceAttributeName` array that matches the name of the group defined in the `filter` | Removed if not defined by the IdP in `sourceAttributeName` and matching name of the group in `filter` | Unchanged | Unchanged | > **Note:** Group provisioning action is processed independently from profile sourcing.Specifies the action during authentication when an IdP user is linked to a previously suspended Okta userBehavior for a previously suspended IdP user during authentication.Sends an asynchronous push notification to the device for approval by the user.Sends an asynchronous push notification to the device for approval by the user.Indicates whether you must use a hardware key storePushProviderVerifies an answer to a `question` factorRealmRealmAssignmentRealmAssignmentOperationResponseThe status of the asynchronous operationDefinition of the realm assignment operationConfiguration defintion of the realmRealm assignment actionAction that assigns a user to a realmRealmProfileUsed to store partner users.Specifies a secret question and answer that's validated (case insensitive) when a user forgets their password or unlocks their account.The refresh tokenRegistrationInlineHookRegistrationInlineHookCommandGets or Sets typeRegistrationInlineHookPPDataRegistrationInlineHookPPDataAllOfDataRegistrationInlineHookPPDataAllOfDataContextRegistrationInlineHookPPDataAllOfDataContextUserRegistration inline hook requestThe type of registration hook.Registration inline hook responseRegistrationInlineHookSSRDataRegistrationInlineHookSSRDataAllOfDataRegistrationInlineHookSSRDataAllOfDataContextRegistrationResponseRegistrationResponseCommandsInnerFor the registration inline hook, the `error` object provides a way of displaying an error message to the end user who is trying to register or update their profile. * If you're using the Okta Sign-In Widget for Profile Enrollment, only the `errorSummary` messages of the `errorCauses` objects that your external service returns appear as inline errors, given the following: * You don't customize the error handling behavior of the widget. * The `location` of `errorSummary` in the `errorCauses` object specifies the request object's user profile attribute. * If you don't return a value for the `errorCauses` object, and deny the user's registration attempt through the `commands` object in your response to Okta, one of the following generic messages appears to the end user: * \"Registration cannot be completed at this timeRegistrationResponseErrorErrorCausesInnerRelease channel for auto-updateReplaceUserClassificationGets or Sets RequiredEnumResendUserFactorType of the factorResetPasswordTokenConditions for further restricting a resource.Specific resources to excludeA [JSON Web Key (JWK)](https://tools.ietf.org/html/rfc7517) is a JSON representation of a cryptographic key.<x-lifecycle-container><x-lifecycle class=\"ea\"></x-lifecycle></x-lifecycle-container>A [JSON Web Key Set](https://tools.ietf.org/html/rfc7517#section-5) for encrypting JWTs minted by the custom authorization serverResourceSetResourceSetBindingAddMembersRequestResourceSetBindingCreateRequestResourceSetBindingEditResponseResourceSetBindingEditResponseLinksResourceSetBindingMemberResourceSetBindingMembersResourceSetBindingMembersLinksResourceSetBindingResponseResourceSetBindingResponseLinksResourceSetBindingRoleResourceSetBindingRoleLinksResourceSetBindingsResourceSetBindingsLinksResourceSetLinksResourceSetResourceRelated discoverable resourcesResourceSetResourcePatchRequestResourceSetResourcePostRequestResourceSetResourcePutRequestResourceSetResourcesResourceSetResourcesLinksResourceSetsLink objectsGets or Sets ResponseModeGets or Sets ResponseTypeGets or Sets ResponseTypesSupportedRevokeRefreshTokenHrefObjectThe subject's identifier has changed, which is either an email address or a phone number change<x-lifecycle class=\"oie\"></x-lifecycle> An object that references detected risk events.RiskEventRiskEventSubjectThe risk level associated with the IPRiskPolicyRuleConditionRiskProviderAction taken by Okta during authentication attempts based on the risk events sent by this providerSpecifies a particular level of risk to match onThe level to matchRoleRoleAssignedUserRoleAssignedUsersRole assignment typeList of all user role governance sourcesThe resource of a grantThe resources of a grantUser role governance sourceRoleGovernanceSourceLinksRoleTarget| Role type | Description | |------------------------------|-------------------------------------------------------------| | ACCESS_CERTIFICATIONS_ADMIN | Access Certifications Administrator IAM-based standard role | | ACCESS_REQUESTS_ADMIN | Access Requests Administrator IAM-based standard role | | API_ACCESS_MANAGEMENT_ADMIN | Access Management Administrator standard role | | APP_ADMIN | Application Administrator standard role | | CUSTOM | Custom admin role | | GROUP_MEMBERSHIP_ADMIN | Group Membership Administrator standard role | | HELP_DESK_ADMIN | Help Desk Administrator standard role | | ORG_ADMIN | Organizational Administrator standard role | | READ_ONLY_ADMIN | Read-Only Administrator standard role | | REPORT_ADMIN | Report Administrator standard role | | SUPER_ADMIN | Super Administrator standard role | | USER_ADMIN | User Administrator standard role | | WORKFLOWS_ADMIN | Workflows Administrator IAM-based standard role |Rotate password request for the privileged resourceRepresents the current value of the Safe Browsing protection levelSchema for the Salesforce app (key name: `salesforce`) To create a Salesforce app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeSalesforceApplicationSettingsThe entitlement management opt-in status for the appSalesforce app instance propertiesSalesforce instance that you want to connect toSalesforce integration typeSAML configuration detailsSaml11ApplicationSaml11ApplicationSettingsThe entitlement management opt-in status for the appSAML 1.1 sign-on mode attributesOkta's `SPSSODescriptor` endpoint where the IdP sends a `<SAMLResponse>` messageSamlAcsInnerSettings for signing and verifying SAML messagesSamlApplicationSamlApplicationSettingsThe entitlement management opt-in status for the appSAML 2.0 sign-on attributes.Identifies the SAML authentication context class for the assertion's authentication statementDetermines the digest algorithm used to digitally sign the SAML assertion and responseDetermines the signing algorithm used to digitally sign the SAML assertion and responseIdentifies the SAML processing rules.Determines if the app supports encrypted assertionsThe encryption algorithm used to encrypt the SAML assertionThe key transport algorithm used to encrypt the SAML assertionSamlAttributeStatementThe operation to filter groups based on `filterValue`The name format of the group attribute.The type of attribute statements objectGeneric `EXPRESSION` attribute statementsThe name format of the attribute.The type of attribute statements object`GROUP` attribute statementsThe operation to filter groups based on `filterValue`The name format of the group attribute.The type of attribute statements objectSamlClaimsInnerFederation Trust Credentials for verifying assertions from the IdP and signing requests to the IdPSAML 2.0 HTTP binding settings for IdP and SP (Okta)Determines whether to publish an instance-specific (trust) or organization (shared) ACS endpoint in the SAML metadataSAMLHookResponseSAMLHookResponseCommandsInnerSAMLHookResponseCommandsInnerValueInnerThe value of the claim that you add or replace, and can also include other attributes.An object to return an error.SAML 2.0 Name Identifier formatsSAMLPayLoadSAMLPayLoadDataDetails of the SAML assertion that was generatedProvides a JSON representation of the `<saml:AuthnStatement>` element of the SAML assertionDetails of the authentication methods used for the SAML assertionSAMLPayLoadDataAssertionClaimsValueSAMLPayLoadDataAssertionClaimsValueAttributesSAMLPayLoadDataAssertionClaimsValueAttributeValuesInnerSAMLPayLoadDataAssertionClaimsValueAttributeValuesInnerAttributesProvides a JSON representation of the `<saml:Conditions>` element of the SAML assertionSpecifies the expiration time, in seconds, of the SAML assertionProvides a JSON representation of the `<saml:Subject>` element of the SAML assertionSAMLPayLoadDataAssertionSubjectConfirmationSAMLPayLoadDataAssertionSubjectConfirmationDataSAMLPayLoadDataContextDetails of the assertion protocol being usedSAMLPayLoadDataContextAllOfProtocolIssuerSAML assertion inline hook requestRelay state settings for IdPThe format used to generate the `relayState` in the SAML request.Algorithm settings used to secure an `<AuthnRequest>` messageXML digital Signature Algorithm settings for signing `<AuthnRequest>` messages sent to the IdP > **Note:** The `algorithm` property is ignored when you disable request signatures (`scope` set as `NONE`).Algorithm settings for verifying `<SAMLResponse>` messages and `<Assertion>` elements from the IdPXML digital Signature Algorithm settings for verifying `<SAMLResponse>` messages and `<Assertion>` elements from the IdPAdvanced settings for the SAML 2.0 protocolGets or Sets SamlSigningAlgorithmKey used for signing requests to the IdPIdP's `SingleLogoutService` endpoint where Okta sends a `<LogoutRequest>` messageThe certificate that Okta uses to validate Single Logout (SLO) requests and responsesIdP's `SingleSignOnService` endpoint where Okta sends an `<AuthnRequest>` messageFederation Trust Credentials for verifying assertions from the IdPScheduledUserLifecycleActionSchemeApplicationCredentialsSCIM configuration detailsSCIM server schema configurationPassword change optionsPATCH operation optionsDetermines how Okta evaluates requested scopes for the connection.ScopeResourceHrefObjectIndicates whether a device has a screen lock set, and the type or complexity of the screen lock **Note:** This option requires a `screenLockType.include` value.Gets or Sets ScreenLockTypeSecurePasswordStoreApplication`template_sps` is the key name for a SWA app instance that uses HTTP POST and doesn't require a browser pluginSecurePasswordStoreApplicationSettingsThe entitlement management opt-in status for the appSecurePasswordStoreApplicationSettingsApplicationSecurityEventSecurityEventReasonThe request schema for creating or updating a Security Events Provider.Information about the Security Events Provider for signal ingestionThe Security Events Provider responseIndicates whether the Security Events Provider is active or notSecurity Events Provider with issuer and JWKS settings for signal ingestionSecurity Events Provider settingsSecurity Events Provider with well-known URL settingThe event subjectsError object thrown when parsing the Security Event TokenA code that describes the category of the errorJSON Web Token body payload for a Security Event Token sent by the SSF Transmitter.A non-empty set of events.JSON Web Token header for a Security Event Token sent by the SSF TransmitterJSON Web Token body payload for a Security Event TokenA non-empty collection of eventsJSON Web Token header for a Security Event TokenDetermines whether the generated password is the user's Okta password or a randomly generated passwordOkta Support access approval status for self-assigned casesEnables or disables users to reset their own password and defines the authenticators and constraints needed to complete the reset<x-lifecycle class=\"oie\"></x-lifecycle> The type of rule actionServiceAccountDetails for a SaaS app account, which will be managed as a service accountDetails for a SaaS app account, which will be managed as a service accountDetails for managing an Okta user as a service accountDetails for managing an Okta user as a service accountServiceAccountForUpdateDescribes the current status of an app service accountDescribes the detailed status of an app service accountThe type of service accountSessionGets or Sets SessionAuthenticationMethodSessionIdentityProviderGets or Sets SessionIdentityProviderTypeGets or Sets SessionStatusControls whether to show the Sign in with Okta Verify button on the Sign-In WidgetGets or Sets SigningAlgorithmSignInPageSignInPageAllOfWidgetCustomizationsVariant for the Okta sign-in page.SignOnInlineHookThe request body required for a simulate policy operationSimulatePolicyEvaluationsA list of evaluated but not matched policies and rulesA list of undefined but not matched policies and rulesThe result of the policy evaluationSimulateResultConditionsSimulateResultPoliciesItemsSimulateResultRulesThe result of this entity evaluationDetermines if the app supports Single Logout (SLO)Schema for the Slack app (key name: `slack`) To create a Slack app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeSlackApplicationSettingsThe entitlement management opt-in status for the appSlack app instance propertiesDetermines if the app participates in Single Logout (SLO)Request binding typeAttempts to activate an `sms` factor with the specified passcodeVerifies an OTP sent by an `sms` factor challenge.SmsTemplateType of the TemplateThe social authentication token object provides the tokens and associated metadata provided by social providers during social authentication.SourceLinksEdition of the Splunk Cloud instanceThe session of the subject was revokedThe event subjectSupported SSO protocol configurations.Defines the authenticators permitted for the initial authentication step of password recoveryGets or Sets methods<x-lifecycle class=\"oie\"></x-lifecycle> Describes the initial and secondary authenticator requirements a user needs to reset their passwordDetermines which authentication requirements a user needs to perform self-service operations.Defines the secondary authenticators needed for password reset if `required` is true.Gets or Sets methodsStandardRoleStandardRoleAssignmentSchemaSpecify a [standard admin role](/openapi/okta-management/guides/roles/#standard-roles), an [IAM-based standard role](/openapi/okta-management/guides/roles/#iam-based-standard-roles), or `CUSTOM` for a custom role type:Optional embedded resources for the role assignmentTargets configured for the role assignmentApp targetsStreamConfigurationThe Subject Identifier format expected for any SET transmitted.The audience used in the SET.StreamConfigurationCreateRequestThe Subject Identifier format expected for any SET transmitted.Contains information about the intended SET delivery method by the receiverThe delivery method that the transmitter uses for delivering a SETStatus corresponding to the `stream_id` of the SSF StreamThe status of the SSF Stream configurationStreamVerificationRequestSTS connection to a service accountType of connection authentication methodThe authentication protocol type used for the connectionCreate an STS connection for a service accountType of connection authentication methodThe authentication protocol type used for the connectionReference to a service account in [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) formatSTS connection to a vaulted secretType of connection authentication methodThe authentication protocol type used for the connectionCreate an STS connection for a vaulted secretType of connection authentication methodThe authentication protocol type used for the connectionReference to a vaulted secret in [ORN](/openapi/okta-management/guides/roles/#okta-resource-name-orn) formatSubjectThe user identifierGets or Sets SubjectTypeSubmissionActionSubmissionActionsSubmissionCapabilitiesSubmissionCapabilitySubmissionRequestSubmissionResponseSubmissionResponseAppContactDetailsInnerType of contact * `CUSTOMER_SUPPORT` - Public support contact details visible on your OIN catalog page for end users needing assistance with your integration. * `ESCALATION_SUPPORT` - Private support contact used by Okta to reach your organization during emergencies or escalations post-publication of the app (not shared with customers).Format of the contact valueSubmissionResponseConfigInnerSubmissionResponseGlobalTokenRevocationAuthentication method <br> **Note:** Currently, only the `SIGNED_JWT` method is supported.The format of the subjectSubscriptionDiscoverable resources related to the subscriptionThe status of the subscriptionThe supported methods of an authenticatorThe type of authenticator methodSupportedMethodsSettingsSwaApplicationSettingsThe entitlement management opt-in status for the appSwaApplicationSettingsApplicationTacAuthenticatorEnrollmentTelephonyRequestTelephonyRequestDataMessage profile specifies information about the telephony (sms/voice) message to be sent to the Okta userUser profile specifies information about the Okta userTelephony inline hook request bodyTelephony inline hook responseTelephonyResponseCommandsInnerTelephonyResponseCommandsInnerValueInnerStatus of telephony calloutTempPasswordTenantSettingsIntegration Testing InformationOIDC test detailsSAML test detailsSCIM test detailsAn account on a test instance of your app with admin privileges.ThemeResponseThe third-party admin settingThreatInsightConfigurationSpecifies how Okta responds to authentication requests from suspicious IP addressesVerifies an OTP for a `token` factorTokenAuthorizationServerPolicyRuleActionTokenAuthorizationServerPolicyRuleActionInlineHookGets or Sets TokenDeliveryModeVerifies an OTP for a `token:hardware` factorFor the token inline hook, the `commands` and `error` objects that you can return in the JSON payload of your response are defined in the following sections.TokenHookResponseCommandsInnerTokenHookResponseCommandsInnerValueInnerValue to set the claim to.When an error object is returned, it causes Okta to return an OAuth 2.0 error to the requester of the token.Verifies an OTP for a `token:hotp` factorTokenPayLoadTokenPayLoadDataProvides information on the properties of the access token that Okta has generated, including the existing claims that it containsTokenPayLoadDataContextThe authorization server policy used to mint the tokenThe authorization server policy rule used to mint the tokenDetails of the authentication protocolThe client making the token requestThe authorization server's issuer identifierInformation about the original token request used to get the refresh token being used, when in a refresh token requestDetails of the token requestThe authorization response modeThe authorization response typeToken inline hook requestTokenResourcesHrefObjectTokenResponseThe token type in a `/token` response.Attempts to activate a `token:software:totp` factor with the specified passcodeVerifies an OTP for a `token:software:totp` factorThe type of token for token exchange.Schema for Trend Micro Apex One as a Service app (key name: `trendmicroapexoneservice`) To create a Trend Micro Apex One as a Service app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeTrendMicroApexOneServiceApplicationSettingsThe entitlement management opt-in status for the appTrend Micro Apex One as a Service app instance propertiesTrustedOriginTrustedOriginScopeThe scope type.TrustedOriginWriteActivates a `u2f` factor with the specified client and registration information from the U2F tokenVerifies a `u2f` factor challenge by posting a signed assertion using the challenge `nonce`Specifies the configuration of an input field on an enrollment formUI Schema element options objectSpecifies how the input appearsProperties of the UI schemaUISchemasResponseObjectUpdateAIAgentRequestUpdateDefaultProvisioningConnectionForApplicationRequestUpdateDomainUpdateEmailDomainUpdateFeatureForApplicationRequestUpdateGroupPushMappingRequestUpdateIamRoleRequestUpdateRealmAssignmentRequestUpdateRealmRequestUpdateThemeRequestThe updated request body propertiesUpdateUserRequestThe ID of the user type.UploadYubikeyOtpTokenSeedRequestUserThe target status of an in-progress asynchronous status transition.UserActivationTokenDescribes how the account is blocked from access.The devices that the block applies toType of access blockUserClassificationSpecifies a set of users to be included or excludedSpecifies primary authentication and recovery credentials for a user.Specifies primary authentication and recovery credentials for a user.UserDeviceUserFactorActivation requests have a short lifetime and expire if the activation isn't completed before the indicated timestamp.Result of a factor activationUserFactorActivateRequestUserFactorActivateResponseType of the factorUserFactorActivateResponseLinksUserFactorCallUserFactorCallProfileUserFactorEmailUserFactorEmailProfileUserFactorLinksGets or Sets UserFactorProviderUserFactorPushUserFactorPushProfileUserFactorPushTransactionResult of the verification transactionUserFactorPushTransactionRejectedUserFactorPushTransactionRejectedAllOfLinksUserFactorPushTransactionRejectedAllOfProfileUserFactorPushTransactionTimeoutUserFactorPushTransactionTimeoutAllOfLinksUserFactorPushTransactionWaitingNMCUserFactorPushTransactionWaitingNMCAllOfLinksUserFactorPushTransactionWaitingNoNMCUserFactorPushTransactionWaitingNoNMCAllOfLinksResult of a factor verification attemptUserFactorSecurityQuestionUserFactorSecurityQuestionProfileUnique key for the questionUserFactorSMSUserFactorSMSProfileStatus of the factorUserFactorSupportedIndicates if the factor is required for the specified userUserFactorTokenUserFactorTokenAllOfVerifyUserFactorTokenFactorVerificationObjectUserFactorTokenHardwareUserFactorTokenHardwareAllOfVerifyUserFactorTokenHOTPUserFactorTokenHOTPProfileUserFactorTokenProfileUserFactorTokenSoftwareTOTPUserFactorTokenVerifyRSAUserFactorTokenVerifySymantecType of factorUserFactorU2FUserFactorU2FProfileUserFactorVerifyRequestUserFactorVerifyResponseUserFactorVerifyResponseWaitingUserFactorVerifyResponseWaitingEmbeddedResult of a factor verificationResult of a factor verificationUserFactorWebUserFactorWebAuthnUserFactorWebAuthnProfileUserFactorWebProfileUserFactorYubikeyOtpTokenToken statusUserGetSingletonThe target status of an in-progress asynchronous status transition.The embedded resources related to the object if the `expand` query parameter is specifiedSpecifies the details of the patterns to match againstThe type of pattern.Specifies a user identifier condition to match onWhat to match against, either user ID or an attribute in the user's Okta profile.UserIdentityProviderLinkRequestUserImportRequestUserImportRequestDataThe object that specifies the default action Okta is set to takeThe current default action that results when Okta imports a user.The app user profile being importedUserImportRequestDataContextDetails of the app from which the user is being importedThe status of the appThe details of the running import jobProvides information on the Okta user profile currently set to be used for the user who is being imported, based on the matching rules and attribute mappings that were applied.User import inline hook requestUserImportResponseUserImportResponseCommandsInnerThe command types supported for the import inline hook.An object to return an error.UserLifecycleAttributePolicyRuleConditionUserLinkSpecifies link relations (see [Web Linking](https://datatracker.ietf.org/doc/html/rfc8288) available for the current status of a user.UserLockoutSettingsGets or Sets UserNextLoginSpecifies a set of Users to be included or excludedSpecifies the default and custom profile properties for a user.UserProvisioningApplicationFeatureUserRequestSchemaUserResourceHrefObjectUserResponseSchemaUserRiskGetResponseUserRiskGetResponseLinksThe risk level associated with the userUserRiskLevelExistsUserRiskLevelNoneThe risk level associated with the userUserRiskPutResponseUserRiskRequestThe risk level associated with the userUserSchemaUserSchemaAttributeUserSchemaAttributeEnumGets or Sets UserSchemaAttributeFormatUserSchemaAttributeItemsUserSchemaAttributeMasterUserSchemaAttributeMasterPriorityGets or Sets UserSchemaAttributeMasterTypeGets or Sets UserSchemaAttributeMutabilityStringUserSchemaAttributePermissionGets or Sets UserSchemaAttributeScopeGets or Sets UserSchemaAttributeTypeAll Okta-defined profile properties are defined in a profile subschema with the resolution scope `#base`.UserSchemaBasePropertiesUserSchemaDefinitionsUserSchemaPropertiesUserSchemaPropertiesProfileUserSchemaPropertiesProfileItemAll custom profile properties are defined in a profile subschema with the resolution scope `#custom`.Link to the [Application Users](/openapi/okta-management/management/tag/ApplicationUsers/#tag/ApplicationUsers/operation/listApplicationUsers) resourceThe current status of the user.UserStatusPolicyRuleConditionUsersUpdateRequestSchemaThe user type that determines the schema for the user's profile.<x-lifecycle class=\"oie\"></x-lifecycle> Specifies which user types to include and/or excludeUserTypeLinksUserTypePostRequestUserTypePutRequestUser verification setting.Validation detailAction provider validation detailsThe method used to verify a userActivates a `webauthn` factor with the specified attestation and registration information from the WebAuthn authenticatorVerifies a `webauthn` factor challenge by posting a signed assertion using the challenge `nonce`Method attachmentCredential request object for the initialized credential, along with the enrollment and key identifiers to associate with the credentialCredential response object for enrolled credential details, along with enrollment and key identifiers to associate the credentialUser factor variant used for WebAuthn preregistration factorsThe [RP ID](https://www.w3.org/TR/webauthn/#relying-party-identifier) object for WebAuthn configurationThe RP domain object for the WebAuthn configurationIndicates the validation status of the domainWellKnownAppAuthenticatorConfigurationThe type of authenticatorWellKnownAppAuthenticatorConfigurationSettingsWellKnownOrgMetadataSpecifies link relations (see [Web Linking](https://www.rfc-editor.org/rfc/rfc8288)) available for this object using the [JSON Hypertext Application Language](https://datatracker.ietf.org/doc/html/draft-kelly-json-hal-06) specificationMetadata about Okta as a transmitter and relevant information for configuration.A string that indicates the default behavior of newly created streamsWellKnownSSFMetadataSpecUrnWellKnownURIArrayResponseWellKnownURIArrayResponseLinksWellKnownURIObjectResponseWellKnownURIRequestWellKnownURIsRootWellKnownURIsRootEmbeddedContains the customized well-known URI content and linksContains the customized well-known URI content and linksWellKnownURIsRootLinksThe generation of the Sign-in WidgetWorkflowActionProviderWorkflowAvailableActionProviderWorkflowsValidationDetailProviderValidation error typeWsFederationApplication`template_wsfed` is the key name for a WS-Federated app instance with a SAML 2.0 tokenWsFederationApplicationSettingsThe entitlement management opt-in status for the appWsFederationApplicationSettingsApplicationSpecifies the WS-Fed assertion attribute value for filtered groups.Specifies additional username attribute statements to include in the WS-Fed assertionSchema for the Zoom app (key name: `zoomus`) To create a Zoom app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeZoomUsApplicationSettingsThe entitlement management opt-in status for the appZoom app instance propertiesSchema for the Zscaler 2.0 app (key name: `zscalerbyz`) To create a Zscaler 2.0 app, use the [Create an Application](/openapi/okta-management/management/tag/Application/#tag/Application/operation/createApplication) request with the following parameters in the request body.Gets or Sets nameGets or Sets signOnModeZscalerbyzApplicationSettingsThe entitlement management opt-in status for the appZscaler app instance properties